The cookies Lumo sets itself keep members signed in to the dashboard, identify friends and website visitors for measurement, and record where visitors to the Lumo website came from. This article lists each cookie's name, purpose, duration, and category, along with the cookies of the third-party services built into Lumo and what happens when cookies are disabled.
This information is current as of October 2026.
Cookie categories
Lumo groups its cookies into three categories by purpose: strictly necessary, functional, and analytics.
| Category | Description |
|---|---|
| Strictly necessary | Cookies required to use the service, such as for signing in and preventing fraud |
| Functional | Cookies that remember an identification or a choice so the same step does not have to be repeated |
| Analytics | Cookies that measure clicks, traffic sources, and the effect of campaigns |
The cookies Lumo sets do not contain names, email addresses, or phone numbers.
Cookies used in the dashboard
The dashboard (dashboard.lumo.cx) uses three cookies for signing in. They are set in the browsers of Workspace members who use Lumo.
| Name | Purpose | Duration | Category |
|---|---|---|---|
accessToken |
Confirms that the member is signed in | 1 hour (reissued each time the sign-in session is renewed) | Strictly necessary |
refreshToken |
Renews the sign-in session when accessToken expires, without signing in again |
7 days (reissued at each renewal) | Strictly necessary |
googleAuthStateVerifier |
Confirms that a Google sign-in was started in the same browser, to prevent impersonation | 10 minutes (deleted when the sign-in completes) | Strictly necessary |
- All three are sent only to dashboard.lumo.cx
- They carry the HttpOnly, Secure, and SameSite=Lax attributes. Page JavaScript cannot read them, and they are sent only over HTTPS
- Signing out deletes
accessTokenandrefreshToken - The display language and screen preferences are kept in browser storage, not in cookies. They are listed in the "Information stored in the browser other than cookies" section
Cookies set in friends' browsers (tracking links)
When a friend taps a tracking link, such as one on a Rich Menu, a cookie is set in the friend's browser to identify the friend and record the click.
| Name | Purpose | Duration | Category |
|---|---|---|---|
lumo_tl_<ID> |
Identifies the friend who tapped a tracking link and records clicks per friend. From the second tap on, LINE Login is skipped | 90 days (extended at each tap) | Functional, analytics |
lumo_tl_declined_<ID> |
Remembers that the friend did not allow access on the LINE Login consent screen, so the consent screen is not shown again and again. Taps during this period are recorded as clicks that do not identify the friend | 30 days | Functional |
-
<ID>is an alphanumeric string that differs for each LINE Official Account. Opening tracking links of several LINE Official Accounts in one browser does not overwrite one another - The cookies are set on the domain of the tracking link (t.lmt.cx, t.lumo.cx, or a custom domain that you have set up)
- Tracking links in the legacy format (URLs on dashboard.lumo.cx) use
lumo_tlandlumo_tl_declined, without<ID>, for the same purposes. Depending on the LINE Login callback setting, they are set on dashboard.lumo.cx or i.lmt.cx - The value of
lumo_tl_<ID>andlumo_tlcontains the friend's identifier issued by LINE (the user ID) and an expiry time, signed to prevent tampering - They carry the HttpOnly, Secure, and SameSite=Lax attributes
- In-message links (links issued for each broadcast) measure clicks without cookies
Cookies used on websites with the tracking code
On a website where the tracking code is installed (on Shopify, the theme app embed), the following two cookies may be set in visitors' browsers.
| Name | Purpose | Duration | Category |
|---|---|---|---|
lumo_shopper_token |
Identifies a friend who came to the store through a link in a LINE message or through LINE Login. It is used to pass the identification to the cart, to measure product views, and to choose which website friend-add CTA to show | The cookie lasts 180 days. The identifier inside expires on Lumo's side after 30 days and is not used after that | Functional, analytics |
lumo_cta_cg |
To measure the effect of the website friend-add CTA, assigns each visitor to either "shown" or "not shown (comparison group)" and keeps that assignment fixed | 30 days | Analytics |
- Both are first-party cookies, set on the domain of the website where the tracking code is installed
-
lumo_shopper_tokenis set only when an identifier is received on a visit from LINE. Its value is a meaningless string that Lumo maps to the friend on its side -
lumo_cta_cgis set on websites that have a website friend-add CTA. Its value is "t" (shown) or "c" (comparison group) - They are written by page JavaScript, so they do not carry the HttpOnly attribute.
lumo_shopper_tokencarries Secure and SameSite=Lax, andlumo_cta_cgcarries SameSite=Lax - Lumo Tracking on Shopify (product view measurement) does not create any cookie of its own. It only reads
lumo_shopper_token. On stores that show a cookie consent banner, it does not run until the visitor consents to analytics and marketing - The store's own cookies (Shopify and others) are managed by the store operator and Shopify
Cookies used on the Lumo website
The Lumo website (www.lumo.cx) uses one cookie to carry the traffic source of visitors who came from ads or social media through to their sign-up for Lumo.
| Name | Purpose | Duration | Category |
|---|---|---|---|
lumo_ft_attribution |
Records the traffic source of the first visit to the website (UTM parameters, the referring page, the first page opened, and the time) and is used to count where new sign-ups came from | 7 days | Analytics |
- It is set on the whole lumo.cx domain and is read by both the website and the dashboard (dashboard.lumo.cx)
- It carries the Secure and SameSite=Lax attributes. Dashboard JavaScript reads it, so it does not carry the HttpOnly attribute
- The tracking code is also installed on the website, so tracking code cookies such as
lumo_cta_cgmay be set - The website also has cookies from third-party services such as HubSpot and Google Analytics. Their providers are listed in the table in the "Third-party cookies" section
Third-party cookies
The third-party services built into Lumo use cookies and similar technologies at their providers' discretion. The providers decide and may change the names and durations, so refer to each provider's information.
| Service | Where it is used | Purpose | Category | Provider information |
|---|---|---|---|---|
| Google Analytics (loaded through Google Tag Manager) | Dashboard, Lumo website | Usage analytics | Analytics | |
| Microsoft Clarity (loaded through Google Tag Manager) | Lumo website | Analytics of how pages are used | Analytics | Microsoft |
| Stripe | Dashboard (on the contract page, when card details are entered) | Credit card payments and fraud prevention | Strictly necessary | Stripe |
| Paid (Raccoon Financial, Inc.) | When bank transfer (invoice payment) is chosen in the dashboard | Payment fraud prevention | Strictly necessary | Paid |
| Google (sign-in with a Google account) | Google's sign-in screen | Google account authentication | Strictly necessary | |
| LINE (LINE Login) | When LINE Login is used, for example from a tracking link (on LINE's screens) | LINE account authentication | Strictly necessary | LY Corporation |
| Shopify | When Lumo is opened inside the Shopify admin | Integration with Shopify | Strictly necessary | Shopify |
| HubSpot | Lumo website | Site analytics, recording cookie consent, chat, and more | Analytics, functional | HubSpot |
| Zendesk | Help Center (guide.lumo.cx) and inquiries | Displaying the Help Center and receiving inquiries | Strictly necessary, functional | Zendesk |
| Cloudflare | Lumo's domains, the Lumo website, and the Help Center | Protection against malicious traffic | Strictly necessary | Cloudflare |
Information stored in the browser other than cookies
Lumo keeps information that does not need to go to the server with every request in browser storage (localStorage and sessionStorage) instead of cookies. Unlike cookies, this information is not attached to requests automatically.
| Where | Information stored | Storage | How long |
|---|---|---|---|
| Dashboard | Display language and screen preferences (panels opened or closed, table column widths, dashboard filters, recently used stickers, and more) | localStorage | Until deleted |
| Dashboard | Information during sign-in (the screen to return to after signing in, invitations, the result of a sign-in in a pop-up) and text being typed in the AI panel | sessionStorage (partly localStorage) | Until the tab is closed (some items until the sign-in finishes) |
| Dashboard | The traffic source of a new sign-up (UTM parameters, the referring page, and more) | localStorage | 7 days |
| Dashboard opened inside HubSpot or Shopify | Sign-in information (the sign-in cookies are not sent there) | localStorage for HubSpot, sessionStorage for Shopify | HubSpot: discarded after 7 days without use. Shopify: until the tab is closed |
| Websites with the tracking code | The identifier of a friend who came from a LINE link (the LINE user ID, used for web conversion tracking) | localStorage | 5 days |
| Websites with the tracking code | A copy of the same identifier as lumo_shopper_token
|
localStorage | Until deleted (the identifier expires on Lumo's side after 30 days) |
| Websites with the tracking code | Records that the website friend-add CTA was closed or completed, and whether it was shown during the visit | localStorage and sessionStorage | Closed: the number of days set for the CTA. Completed: until deleted. Shown: until the tab is closed |
| Websites with the tracking code | Handover from a form submission to the LINE connection (HubSpot and Klaviyo forms) and prevention of duplicate submissions. For HubSpot forms, the email address entered is kept for up to 10 minutes | sessionStorage | Until the tab is closed |
When cookies are disabled
With the strictly necessary cookies disabled, members cannot sign in to the dashboard. With functional or analytics cookies disabled, links still take visitors to their destinations and pages still display.
| Cookie | When disabled |
|---|---|
accessToken, refreshToken, googleAuthStateVerifier
|
Members cannot sign in to the dashboard. Sign-in with a Google account does not complete either |
lumo_tl_<ID>, lumo_tl
|
The link still opens its destination. Each tap goes through LINE Login or is recorded as a click that does not identify the friend |
lumo_tl_declined_<ID>, lumo_tl_declined
|
Friends who did not allow access in LINE Login may see the consent screen at every tap |
lumo_shopper_token |
The copy in browser storage is used when it exists. When neither is available, the store cannot identify the friend, and the cart and product views are not tied to the friend |
lumo_cta_cg |
For CTAs with a comparison group, the assignment is not kept fixed, so the CTA may be shown on some pages and not on others. The accuracy of the effect measurement also drops |
lumo_ft_attribution |
The traffic source of a new sign-up is not recorded. Use of the service is not affected |
Cookies can be reviewed, deleted, and blocked in the browser settings. The Lumo dashboard does not have a setting to turn cookies on or off by category. For Lumo's use of cookies, also refer to "Use of cookies and similar technologies" in the Privacy Policy.