Cookie Policy
What cookies we use, why, and how to manage your preferences.
This page is provided for transparency. See the full Privacy & AI Rights Center for the complete document set.
The short version
- •Necessary storage supports requested services and remembers chosen settings; it is always on.
- •Functional, Analytics and Marketing activity waits for opt-in. Global Privacy Control disables all three.
- •Choices last 12 months. Use Decline, Save choices, Accept all or the Cookie settings footer control.
This summary is for orientation only. It is not a substitute for the full text, and the numbered sections below govern in the event of any difference.
1. Cookie Categories
Cookies and browser local/session storage are listed below by purpose. Entries apply when the corresponding feature is used, not on every visit. Session storage ends with the tab session; local storage has no automatic expiry unless stated. Third-party cookie names and expiry depend on the provider, browser and login state; where the source does not set them, they are identified as provider-controlled rather than represented as a verified exhaustive provider-cookie list.
Necessary (always on)
- lootmogul-cookie-consent
- Remembers the four category choices, GPC state and choice timestamp.
Duration: 12 months; expired choices require renewal.
Provider: LootMogul - Sign-in session key (sb-…-auth-token), …-code-verifier
- Stores the sign-in session and OAuth verification state in local or session storage. Tokens authorize requested account features.
Duration: Session expiry/refresh controlled by authentication; verifier removed after exchange; local session persists until sign-out or clearing.
Provider: LootMogul authentication - lovable-auth (cookie; Path=/)
- Sign-in session helper. Code requests HttpOnly, Secure, SameSite=Lax; a legacy client-readable fallback is also present. Browser/domain restrictions can affect whether it is set.
Duration: 7 days by default, or the duration passed by the sign-in helper.
Provider: LootMogul authentication - lootmogul_user, strapi_jwt, lootmogul_auth_return_url
- Legacy account/session data and destination for a requested sign-in.
Duration: Account keys until logout/clearing; return destination removed after use.
Provider: LootMogul - theme, lootmogul-country-preference, sidebar:state
- Remembers chosen theme, pricing country and sidebar state.
Duration: Theme/country until changed or cleared; sidebar cookie 7 days, Path=/.
Provider: LootMogul - pwa-install-dismissed, lootmogul_admin_wizard_seen, lm_admin_preferences, lm_pipeline_visible_columns
- Remembers prompt dismissal and chosen administrator display settings.
Duration: Until changed/reset/cleared; no automatic storage expiry.
Provider: LootMogul - notification_sounds_enabled, notification_alert_tone, notification_volume, push_notifications_enabled, push_notification_permission
- Remembers notification choices and browser notification permission. Browser permission is separate from cookie consent.
Duration: Until changed/cleared; browser permission remains browser-controlled.
Provider: LootMogul - notification_dismissed_date, dismissed_role_requests, viewed_role_requests, feed_read_items
- Remembers dismissed/read notifications and feed items.
Duration: Until reset/cleared; dated notification dismissal is checked for the current day.
Provider: LootMogul - studio_fp, studio_free_usage
- Studio session identifier and daily free-use counter for usage limits, not advertising.
Duration: studio_fp: tab session; usage counter resets logically each day but storage remains until replaced/cleared.
Provider: LootMogul - ai-labsx-access, lm_chunk_reload_at
- Remembers granted internal-studio access and prevents repeated recovery reloads.
Duration: Tab session.
Provider: LootMogul - lm-active-instance, lm-active-external-db
- Remembers administrator-selected data connection.
Duration: Until changed/cleared.
Provider: LootMogul - reCAPTCHA (_GRECAPTCHA and provider-controlled security storage)
- Protects contact and application forms against automated abuse. Sends browser/network and interaction signals to Google when these forms load.
Duration: Provider-controlled; _GRECAPTCHA commonly lasts 6 months; exact deployed cookies and lifetime cannot be determined from app code.
Provider: Google - Requested payment/authentication provider storage
- Security and transaction/session processing when you choose checkout or external sign-in. Not a site-wide advertising tag.
Duration: Provider-controlled; exact browser cookies depend on the transaction and provider.
Provider: Stripe, MoonPay and selected sign-in provider
Functional
- Google Fonts (no app-created cookie/storage key)
- Downloads Plus Jakarta Sans and Inter only with Functional permission; Google receives IP/network/browser request information.
Duration: Browser cache lifetime is provider/browser-controlled; no app storage expiry.
Provider: Google - lootmogul_sports_cache
- Caches sports data to speed repeat retrieval, only with Functional permission.
Duration: 1-hour cache validity; entry remains until replaced or cleared.
Provider: LootMogul
Analytics
- lm_analytics_session
- Tab-session identifier for click coordinates, element metadata/text, page paths/titles, user ID, viewport, scroll depth, time and feature events. Only collected after Analytics permission.
Duration: Tab session; removed on withdrawal.
Provider: LootMogul - lm_ab_session
- Experiment assignment identifier; assignment and conversion events are stored by the site.
Duration: Until cleared or Analytics withdrawal; no independent automatic expiry.
Provider: LootMogul - logout_debug_session, logout_debug_history
- Logout troubleshooting steps, timestamps, status and errors.
Duration: Active tab session removed on completion; history capped at 10 entries until clearing/withdrawal.
Provider: LootMogul - Google Analytics: _ga, _ga_<measurement suffix>; provider-controlled analytics storage
- Page/feature/transaction measurement when a real measurement ID is configured. May include authenticated user ID, account email domain and event metadata. Google signals and ad personalization are disabled by this site.
Duration: GA commonly uses up to 2 years; exact provider expiry is not set in app code. Optional collection requires a current 12-month consent choice.
Provider: Google
Marketing
- lm_partner_funnel_attribution
- CTA source, intent, landing path, referrer, UTM campaign fields and timestamp for contact attribution; requires Marketing permission.
Duration: Tab session; removed on withdrawal.
Provider: LootMogul - Facebook SDK (provider-controlled Facebook cookies, including login/device identifiers)
- Loads only with Marketing permission when Facebook sign-in is requested; may disclose IP/browser information and Facebook identifiers to Meta. No Meta Pixel or Conversions API installation was found in this app.
Duration: Controlled by Meta and its login state; exact names and lifetimes are not specified by app code.
Provider: Meta / Facebook - YouTube embedded player (provider-controlled cookies/storage)
- Plays the outreach overview video only on request with Marketing permission; YouTube receives browser/network and viewing information and may use it across services.
Duration: Provider-controlled; exact names and lifetimes depend on YouTube login/player state, not app code.
Provider: Google / YouTube
2. Your Choices
NextGenTM, Inc., a Delaware corporation, doing business as LootMogul, operates LootMogul at lootmogul.com. Optional technologies do not load, run or write before opt-in. Decline leaves only Necessary enabled; Save choices saves your selections; Accept all enables optional categories unless GPC is on. Choices expire after 12 months and can be withdrawn through Cookie settings in the footer. Withdrawal stops future optional collection and removes app-controlled optional identifiers; it cannot undo prior lawful disclosure or delete third-party-domain storage we cannot access. Questions: privacy@nextgentm.com, 831 N Tatnall Street, Suite M #275, Wilmington, DE 19801, United States.
3. Global Privacy Control
Global Privacy Control overrides saved acceptance and switches Functional, Analytics and Marketing off for this browser. Necessary account/security services and storage remembering a setting you chose remain available. The same model applies regardless of region. Do Not Sell or Share requests may also be sent to privacy@nextgentm.com.