metzia sets a small number of first party cookies. Each one keeps you signed in, or records which link brought you to metzia or to a seller. metzia sets no advertising cookie and no tracking cookie from another company.
The cookies we set
The table lists every cookie that metzia sets, on its own domain.
| Name | Purpose | Category | Lifetime | Set by |
|---|---|---|---|---|
DS | Holds your buyer session, so you stay signed in | Strictly necessary | 10 minutes | The Descope script at sign in, and the metzia server when it renews your session |
DSR | Renews your buyer session when the DS cookie expires | Strictly necessary | 28 days | The Descope script at sign in, and the metzia server when it renews your session |
wos-session | Holds a seller or staff session, sealed so that your browser cannot read it | Strictly necessary | 400 days | The metzia server, through WorkOS AuthKit |
oc_click | Records the metzia link you followed to a seller, so a commission can match your visit | Strictly necessary | 90 days | The metzia server, when you follow a link to a seller |
oc_src | Records the tagged link that first brought you to metzia | Strictly necessary | 30 days | The metzia server, on your first tagged visit |
oc_landing | Records the path of the first page you visited, with no query string | Strictly necessary | 30 days | The metzia server, on your first tagged visit |
oc_ref | Records the host name of the site that sent you to metzia | Strictly necessary | 30 days | The metzia server, on your first tagged visit |
The Descope script and the metzia server set DS and DSR so that a script on
the page can read them. The step up check needs that access. Only the metzia
server can read the other cookies.
The metzia project at Descope sets the DSR lifetime to 28 days. Your
browser can delete the cookie sooner. Safari limits the lifetime of a cookie
that a script writes.
metzia sets no oc_click cookie for a known crawler.
Page view counting
metzia counts page views on its public pages with Vercel Web Analytics. The counter sets no cookie and stores nothing in your browser. It loads from the metzia domain and reports to the metzia domain.
For each page view, the counter receives these items:
- The path of the page, with no query string and no hash.
- The route pattern of the page, for example
/docs/[slug]. - The user agent of your browser, which names the browser and the device.
- The address of the site that sent you, when it is another site.
- The IP address of the request, as every web request carries one.
Vercel does not use a cookie to tell one visitor from another. It makes a hash from the incoming request instead. Vercel discards that visitor session after 24 hours. Vercel states that the data it records is anonymous and is not tied to an individual or to an IP address. It can store the time, the path, the route pattern, the referrer, a location, the operating system, the browser, and the device type with each page view.
Browser storage
The Descope script also keeps some items in the storage of your browser on the sign in, sign up, and account security pages. The storage is not a cookie, and your browser does not send it to metzia. The table lists every item that the Descope script can write. A sign out does not clear these items. Clear the site data in your browser to remove them.
| Name | Purpose | Category | When it clears |
|---|---|---|---|
DSI | Holds the identity token of your sign in, when Descope returns one | Strictly necessary | When the Descope script ends the session in your browser |
DSRCN | Holds the name of the renewal cookie, when Descope uses a custom name | Strictly necessary | When the Descope script ends the session |
descopeFlowNonce and an id | Protects one sign in attempt against a replayed request | Strictly necessary | Expires after 3 hours, or 2 days for the first step |
DTD | Marks this device as trusted, when you choose that in a sign in step | Strictly necessary | When you clear the site data |
DKD | Lets Descope recognize this device at the next sign in, which protects your account | Strictly necessary | When you clear the site data |
dls_last_submitted_login_id | Holds the email you typed, so that your password manager can save it | Strictly necessary | When you close the tab |
dls_last_auth_in_flight | Records the sign in method you used on each step, when the flow asks for it | Strictly necessary | When a sign in attempt starts or ends |
dls_ab_testing_id | Holds a random number from 1 to 100 that selects a version of the sign in flow | Strictly necessary | When you clear the site data |
fp | Holds a device fingerprint result, when the sign in flow turns on fingerprinting | Strictly necessary | Expires after 24 hours |
How to remove a cookie
You can delete a cookie in the settings of your browser at any time. Sign out
to remove DS and DSR.
If you delete oc_click, a seller may not credit your purchase to metzia. The
price you pay does not change.
When this text changes
This document carries a version date. metzia publishes a new version before it sets a new cookie.
Questions
Write to support@metzia.ai with a question about this document.