EKGIS Naturals
Cookies and browser storage
litecheckout hosts checkout and customer-account pages for EKGIS Naturals on a *.litecheckout.io subdomain. This technical notice describes the cookies and browser storage used by litecheckout and Stripe on those pages, and by Google Analytics, which this merchant has configured for checkout.
Current inventory
| Name and location | Purpose and audience | When it appears | Lifetime |
|---|---|---|---|
__stripe_midStripe machine identifier; first-party on this origin, not iframe-confined | Helps Stripe prevent fraud on payment-bearing checkout surfaces. | May be set for a visitor when a surface loads Stripe.js, before the visitor interacts with payment fields. | 1 year, according to Stripe on 24 Aug 2026. |
__stripe_sidStripe session identifier; first-party on this origin, not iframe-confined | Helps Stripe prevent fraud on payment-bearing checkout surfaces. | May be set for a visitor when a surface loads Stripe.js, before the visitor interacts with payment fields. | 30 minutes, according to Stripe on 24 Aug 2026. |
_gaGoogle Analytics cookie; first-party, restricted to this exact host | Distinguishes returning visitors for the merchant's Google Analytics 4 property so checkout starts and purchases can be counted and attributed to the merchant's storefront traffic. | On the checkout page, once the Google tag loads, unless the visitor is in the EEA, the UK, or Switzerland, where analytics storage is denied by default and no cookie is set. | Up to 2 years by default, according to Google's Google tag configuration reference on 12 Sep 2026. |
_ga_N2WMMBVYXLGoogle Analytics session cookie; first-party, restricted to this exact host | Keeps the visitor's session state for the same Google Analytics 4 property. | Same conditions as _ga. | Up to 2 years by default, according to Google's Google tag configuration reference on 12 Sep 2026. |
lc:ga4:begin:<digest>Browser sessionStorage | Marks that a checkout-start event was already sent for this checkout in this tab, so a refresh does not send it twice. The digest cannot be turned back into the checkout link. | When the checkout page first sends that event. | Ends with that tab's browser session. |
lc:ga4:purchase:<orderNumber>Browser localStorage | Marks that the purchase event for that order number was already sent from this browser, so a refresh or a return to the confirmation does not count the order twice. | When the confirmed order is first shown. | Until the browser clears site data; it holds only the order number and a timestamp. |
__Host-lc_customer_sessionHttpOnly litecheckout cookie | Authenticates a signed-in customer account. It is not set for a guest shopper. | After the customer completes email-link or emailed-code sign-in. | Stored for up to 24 hours by default, or up to 365 days only when persistent sign-in is affirmatively requested. The session can become unusable earlier after 6 hours of inactivity by default, after 30 days of inactivity for persistent sign-in, or after server-side revocation. Logout clears the cookie. |
__Host-lc_booking_group_resume_<publicRef>HttpOnly litecheckout cookie | Lets a guest or signed-in shopper resume the booking group represented by the public reference. | After a valid booking-group recovery action is used. | Up to 24 hours, or until logout. |
__Host-lc_subscription_recovery_<handle>HttpOnly litecheckout cookie | Lets a guest or signed-in customer continue a specific subscription-payment recovery. | After a valid subscription recovery action is used. | Up to 1 hour, or until logout. |
litecheckout:fields:<opaqueCheckoutToken>Browser sessionStorage | Restores a checkout draft containing entered name, email, phone, company, delivery address, country, and marketing choice after a refresh. It never contains card details. | Written in the shopper's current tab while checkout fields are edited. | Cleared after a completed order when possible; otherwise it ends with that tab's browser session. |
litecommerce.checkout-account-selection.v1: <opaqueCheckoutToken>Browser sessionStorage | Remembers the account email the shopper explicitly selected while checkout was open, so the same tab can present the permitted pending-payment account recovery after a refresh. | Written when the shopper explicitly continues with the signed-in account during checkout. | Cleared after a completed switch to another account when possible; otherwise it ends with that tab's browser session. |
litecommerce.checkout-account-switch.v1: <opaqueCheckoutToken>Browser sessionStorage | Holds the random retry identifier and opaque switch-epoch recovery state for one pending-payment account change. It contains the selected and branch email, but no payment or sign-in credential. | Created before the current tab asks litecommerce to pause the prepared payment, then updated as the recovery branch is admitted and identified. | Cleared after the switched checkout is rebound and its new payment is prepared when possible; otherwise it ends with that tab's browser session. |
lc:booking-group:<publicRef>:initial-checkoutBrowser sessionStorage | Holds a random retry key so an uncertain booking checkout response can be retried without creating another attempt or charge. | Created in the current tab when booking-group payment is prepared, then sent to litecommerce with that request. | Reused after an uncertain response and retained until that tab's browser session ends. |
In production, the three __Host-lc_* cookies above are Secure, HttpOnly, SameSite=Lax, and restricted to the host-wide / path. Local development uses equivalent cookie names without the __Host- prefix so HTTP localhost works.
What the inventory means
- Keeping the checkout field draft in sessionStorage does not itself upload the draft. litecommerce receives the current delivery address while loading or updating shipping options, which can happen before the shopper continues or submits. When checkout is bound, litecommerce also receives the entered contact values and, when enabled, the marketing choice.
- Card details are entered in Stripe-hosted fields and sent directly to Stripe. litecommerce does not receive or store card details.
- Closing the tab ends the sessionStorage entries above, not the cookies. In particular,
__stripe_midcan persist for up to 1 year. - This notice does not ask for or record cookie consent. litecheckout currently has no cookie-consent banner or preference control.
- This merchant has configured Google Analytics 4 for checkout. Google receives a page view of the checkout route with the checkout link token removed, a checkout-start event, and a purchase event carrying the order number, totals, and item names and quantities. It never receives the checkout link token, payment details, or your email, phone, or address. Advertising features and Google signals are turned off in the tag, and visitors in the EEA, the UK, and Switzerland are measured without cookies. The merchant's privacy policy describes their use of Google Analytics.
- A tenant-enabled marketing checkbox is unchecked by default and starts a newsletter double opt-in. It is not cookie consent.
Storage inside Stripe's cross-origin payment iframe cannot be read or enumerated by litecheckout and is not included here. Stripe controls that technology and may change it. See Stripe's Privacy Center for how Stripe.js works and Stripe's Cookie Settings for its current cookie list.
How this inventory was checked
A guest-browser inspection on 19 Aug 2026 recorded names and presence only; no cookie or storage values were captured. On 24 Aug 2026, the litecheckout source was checked for application-set cookies, storage keys, purposes, audiences, and upper lifetimes, and the Stripe lifetimes above were checked against Stripe's published Cookie Settings.
The Google Analytics rows describe litecheckout source as of 12 Sep 2026 and Google's documented cookie names and default lifetime; they appear only for merchants who have configured a measurement ID.
Those dates identify observations, current application behavior, and current provider documentation. They are not promises that retention or provider behavior will never change.