Consent and storage

Before the Grona script goes live, your privacy and legal reviewers will want to know what it stores and when. This page covers the two consent modes, what runs before a visitor consents in each, and every storage key the script writes.

Consent modes

Each workspace has a consent mode. Set it in the Grona dashboard under Settings > Privacy and consent, where the question is “Must visitors consent before Grona stores anything?”. “Yes, wait for consent” is Wait for consent below; “No, consent isn’t needed” is Not required.

Mode	Before consent	When it applies
Not required (also how a workspace that has not answered behaves)	Everything runs from the first page view: the visitor id is stored, variations apply and events are sent.	When you answer “No, consent isn’t needed”, and while the question shows “Not answered yet”.
Wait for consent	Nothing is stored and nothing is sent, apart from the timeout report below. The visitor sees your original page.	Only when you answer “Yes, wait for consent”.

By default, Grona does not wait for consent. If you need consent before analytics storage, select Wait for consent.

How Wait for consent behaves

• Grona reads the visitor’s answer from your consent tool. “Not answered yet” counts as no. See Consent platforms for the tools it reads.
• Consent is read once per page view. A visitor who accepts while on a page is counted from their next page view; the page where they accepted shows your original content and is not counted.
• Without consent, visitors see your original page and are left out of tests. The one exception is an audience rule group that shows one version to everyone it matches, with no split, and needs no storage (for example a rule on device, location, time of day or language). Visitors who match such a group see its version, and nothing is stored or sent for them either.
• Goals from Shopify’s custom pixel are always dropped in this mode, because the pixel’s sandbox cannot see the visitor’s consent.

What runs regardless of consent

• Preview links apply their variation without consent, and record no page views, clicks or conversions in either mode. They follow the consent mode for storage: under Wait for consent nothing is stored before consent, and under Not required the visitor and visit ids are created as on any page.
• The anti-flicker timeout report. antiflicker.js sends a timeout report to api.grona.ai/track/antiflicker if its 5-second timer has to reveal the page, whatever your consent setting is. It carries your workspace id, the page URL, the user agent and a duration, and it includes the visitor and visit ids only when main.js has already set them, which never happens before consent under Wait for consent.

main.js also sends a loaded timing report when it starts on each page view, with no visitor or visit id. Under Wait for consent it is sent only when the visitor has consented. Prevent flicker describes both reports.

Note

Some consent tools block scripts until the visitor accepts, for example by rewriting them as type="text/plain". If yours holds back the Grona snippet, nothing of Grona runs before consent, including the anti-flicker script, and installation checks report the script as absent. Grona’s own Wait for consent mode does the same job while keeping the snippet in place.

No JavaScript consent API

There is no JavaScript call or flag to pass consent to Grona. The only public JavaScript command is grona('track', …). If your consent tool is not one Grona reads, have it send a Google Consent Mode update; see Consent platforms.

Cookies

main.js writes no cookies. It reads two kinds: the consent cookies of Cookiebot and OneTrust (in Wait for consent mode), and Shopify’s localization cookie for market targeting.

Storage

Everything Grona stores is first-party Web Storage on your own domain. Grona sets no third-party storage. Which keys appear depends on the features your campaigns use.

Key	Storage	Purpose	Lifetime	When present
grona_client_data	localStorage	{clientId, createdAt}: a random visitor id, used to assign variations and to connect page views and goals	1 year, then a new id	Always, unless consent is required and not given
grona_session_id	sessionStorage	The visit id	The tab’s life; renewed after 30 minutes of inactivity or 7 hours in total	Always, unless consent is required and not given
grona_session_start	sessionStorage	When the visit started	As grona_session_id	Always, unless consent is required and not given
grona_last_activity	sessionStorage	Time of the last mouse, key, scroll, touch or click	As grona_session_id	Always, unless consent is required and not given
grona_recent_pageviews	sessionStorage	Page-view ids from the last 90 seconds, so a quick reload is not counted twice	Entries expire after 90 seconds	Always, unless consent is required and not given
grona_consent	localStorage	{granted: true, at}: Grona’s note that the visitor consented to analytics. It never stores a “no”.	1 year, or until a consent tool says no	Wait for consent workspaces only
grona_visit_note	localStorage	Up to 4 KB: counts of earlier visits, kinds of pages seen, goals reached, and ad-link values an audience rule names. Never an address or form input.	Until the campaign ends, or a set number of days after the first visit (30 by default)	Audience rules that use visit history
grona_this_visit	sessionStorage	Counters for this visit, such as named page lists and cart adds	The visit	Audience rules that use this visit’s activity
grona_orders	localStorage	The last 100 order or booking codes, to avoid counting one twice	Until replaced	Workspaces using Grona’s built-in booking or store listeners
grona_cart_changed	sessionStorage	A note that a form added to the cart, so the next page reads the cart once	Until read	Campaigns that use cart contents
grona_cart_reached	sessionStorage	Cart thresholds already passed in this visit	The visit	Campaigns that measure cart thresholds

Under Wait for consent, no key except grona_consent is written until the visitor consents, including the feature keys in the last five rows.

Visitors can also see these on your pages, although they are not storage:

• the ?v=grona- query parameter, added to the address after a variation applies;
• data-grona-* and data-gro-original_* attributes on changed elements.

Storage is per origin, so a visitor has separate keys on www.shop.example.com and shop.example.com. See Domains and subdomains. When storage is blocked, Grona keeps its values in memory for that page only.