CURRENT DEPLOYED-SITE INVENTORY
Cookie Policy
Effective September 12, 2026 • Last updated October 1, 2026
What this covers
This inventory is based on a scan of the deployed LoreRipz.com website on October 1, 2026, plus inspection of the site’s active code paths. Optional tools are blocked until the corresponding category is accepted. You can reopen Cookie Preferences from every public-page footer.
Cookies and local storage
| Name / provider | Purpose | Category | Duration | Party |
|---|---|---|---|---|
lr_consent / LoreRipz | Stores anonymous ID, choices, policy version, timestamp, expiration, and GPC status so optional tools remain blocked or enabled as selected. | Strictly Necessary | 180 days | First-party |
lr_analytics_session / LoreRipz | Random session identifier used to count opted-in visits, page views, landing pages, traffic sources, campaigns, destination actions, bounce rate, and website purchase conversions. If checkout starts during the session, this random identifier may be copied to the order record; it contains no name, email, full IP address, form contents, or payment credentials. | Analytics | 30 minutes after the latest page view; order linkage follows transaction-record retention | First-party |
__cf_bm / Cloudflare | Bot-management and security cookie observed in the deployed site response. It helps distinguish legitimate requests from automated abuse. | Strictly Necessary | About 30 minutes | First-party cookie set by hosting/security provider |
loreripz-control-pin / LoreRipz | Browser local storage used only on protected operator surfaces to remember the operator-entered control PIN. It is not used for public visitor tracking. | Strictly Necessary (operator only) | Until cleared from the browser | First-party local storage |
loreripz-cart / LoreRipz | Browser local storage that remembers selected product IDs, quantities, and public catalog details so a shopper can continue checkout. It does not contain payment credentials. | Strictly Necessary (cart) | Until checkout, removal, or browser storage is cleared | First-party local storage |
loreripz-wishlist / LoreRipz | Remembers Coconut decks a visitor chooses to save on this device. | Functionality; opt-in required | Until Functionality consent is withdrawn or browser storage is cleared | First-party local storage |
loreripz-recently-viewed / LoreRipz | Remembers up to six recently viewed Coconut deck pages on this device. | Functionality; opt-in required | Until Functionality consent is withdrawn or browser storage is cleared | First-party local storage |
loreripz-pack-market-arrival-date / LoreRipz | Remembers that the Pack Market arrival animation was shown on this device for the current day. | Functionality; opt-in required | Current local calendar date, then replaced; removed on withdrawal | First-party local storage |
loreripz-back-panel-iconic-draw and loreripz-back-panel-hit-celebration / LoreRipz | Operator-display storage that prevents a broadcast device from replaying the same Iconic draw or hit celebration. It is not used on ordinary public shopping pages or for visitor tracking. | Strictly Necessary (operator display only) | Until replaced by a newer event or browser storage is cleared | First-party local storage |
| Stripe checkout/security technology | Creates and protects a payment session, processes payment, and prevents fraud after a shopper starts checkout. | Strictly Necessary | Session or as set by Stripe | Third-party on Stripe checkout |
Pixels, analytics, ecommerce analytics, and marketing
| Tool | Current status | Category if added | Duration / party |
|---|---|---|---|
| LoreRipz first-party traffic analytics | Active only after Analytics consent; records a random session ID, page path, referrer hostname, allowlisted UTM source/medium/campaign values, whether a Google Ads click ID was present (not the ID), product/cart/checkout or TikTok/Discord action type, and timestamp | Analytics; opt-in required | Raw events retained up to 13 months; first-party |
| Google Analytics / Google Tag Manager analytics | Not installed; no request detected | Analytics; opt-in required | None |
| Meta / Facebook Pixel | Not installed; no request detected | Advertising/Marketing; opt-in required | None |
| TikTok Pixel | Not installed; no request detected | Advertising/Marketing; opt-in required | None |
| Heatmap / session recording | Not installed; no request detected | Analytics; opt-in required | None |
| Newsletter / marketing SDK | Not installed; no request detected | Advertising/Marketing; separate signup opt-in required | None |
| LoreRipz ecommerce reporting | Private operator reporting for orders, products, sales, discounts, refunds, taxes, fees, costs, shipping, channels, and estimated contribution profit. Operational order records are not advertising analytics; purchase attribution to a website session occurs only after Analytics consent. | Strictly Necessary for operational records; Analytics for session attribution | Transaction/accounting records retained up to seven years; first-party |
Optional media and third-party requests
| Provider | Purpose | Category | Duration | Party |
|---|---|---|---|---|
| Laughing Place | Displays the Pocahontas Iconic card image | Functionality | Single page request; provider logs may vary | Third-party |
| Star City Games / BigCommerce image service | Displays the Belle & Beast Iconic card image | Functionality | Single page request; provider logs may vary | Third-party |
| Total Cards | Displays the Merida Iconic card image | Functionality | Single page request; provider logs may vary | Third-party |
| TikTok and Discord | External community destinations; no embed loads on LoreRipz.com | No on-site cookie; the provider applies its policies after you click | Set by destination after click | Third-party destination |
What the deployed scan found
Before consent, the site loads its application code, styles, logo, and live-data API from LoreRipz.com, plus Cloudflare’s necessary security cookie. The first-party analytics request and session cookie remain blocked until Analytics is accepted. No Google, Meta, TikTok, advertising, heatmap, session-recording, chat, newsletter, customer-account, or social/livestream embed request is permitted. The optional card images and optional device preferences remain blocked until Functionality is accepted. The site’s Content Security Policy blocks unlisted scripts, frames, and network connections, so Tag Manager cannot be added around the preference gate without a deliberate policy and code update.
Changing or withdrawing consent
Open Cookie Preferences in the footer. Rejecting or withdrawing deletes optional cookies that LoreRipz can delete and prevents future optional scripts and requests. Third-party cookies created on another provider’s domain cannot be deleted by LoreRipz; use that provider’s controls or browser settings. Global Privacy Control locks advertising/targeted-sharing tools off for the visit.