Cookie Notice
Last updated October 16, 2026
This page lists what DM DESK stores in your browser. It covers dm-desk.com, the DM DESK dashboard and app, and the chat a business puts on its own website.
No advertising or tracking cookies. DM DESK sets no advertising cookies and no tracking cookies, and it loads no advertising tags. The one script that counts page views is described in section 2.
1. On dm-desk.com
DM DESK sets no cookie when you open a page of this website while signed out, unless a row below says so. Each item below is set when you do what the table says. The table also says whether it is a cookie or is kept in your browser's storage.
Scroll the table sideways to see what each one holds and how long it stays.
| Name and kind | When it is set | What it holds | How long it stays |
|---|---|---|---|
| sb-(project id)-auth-tokenCookie | When you sign in. | Your sign in session. It is stored in parts when it is long. | Up to 400 days after it was last renewed. Removed when you sign out. |
| sb-(project id)-auth-token-code-verifiersb-(project id)-auth-token-flow-(id)-code-verifiersb-(project id)-auth-token-flows-code-verifierCookie | When you sign up, ask for a sign in link, ask for the confirmation email again, or ask to reset your password. | A one time code that ties the emailed link to this browser. | Up to 400 days. Removed when you sign out. |
| dmdesk_active_businessCookie | Signed in, when you switch between businesses, open an alert for another business, or finish connecting Clover. | Which business you are viewing. | 1 year. |
| dmdesk_meta_oauth_statedmdesk_meta_returnCookie | Signed in, while you connect Instagram. | A random check value, and a note to bring you back to setup. | 10 minutes. |
| dmdesk_square_oauth_stateCookie | Signed in, while you connect Square. | A random check value. | 10 minutes. |
| dmdesk_shopify_oauth_statedmdesk_shopify_oauth_shopCookie | When DM DESK is installed from Shopify. | A random check value and the store's address. | 10 minutes. |
| dmdesk_clover_oauth_statedmdesk_clover_from_cloverCookie | While a Clover account is being connected. | A random check value, and a mark that the request came from Clover. | 10 minutes. |
| dmdesk_clover_pendingCookie | While a Clover account is being connected, until you confirm the business. | The connection and the business details Clover sent, encrypted. | 30 minutes, or up to 24 hours while an email address is being confirmed. |
| dmdesk_push_tokenCookie | In the DM DESK iPhone app, when you allow notifications. | The device's notification token. | 1 year. Removed when you sign out. |
| va-disableCookie and local storage | When you open a page with ?analytics=off at the end of its address. | A mark that this browser is not counted in our page views. | The cookie 1 year, and it is set again while the local storage mark is there. Opening a page with ?analytics=on removes both. Otherwise DM DESK does not remove the mark. |
| dmdesk_try_voice_codeLocal storage | On our voice ordering demo, after an access code is accepted. | The access code. | DM DESK does not remove it. |
| dmdesk:setup-call-card-dismissedLocal storage | Signed in, when you close the setup call card. | A mark that you closed it. | DM DESK does not remove it. |
The sign in, sign up and password pages also write a test value to local storage and remove it at once, to check that storage works.
The chat on dm-desk.com is the same chat businesses use. On the pages that carry it, it keeps what section 4 lists.
2. Page view counts
We count page views on our public pages, and a short fixed list of events such as a button click or the chat greeting being shown, with Vercel Web Analytics. When we last checked it, on October 13, 2026, it set no cookie and kept nothing in your browser. Vercel says it tells visitors apart by a hash made from the incoming request, and that a visitor session is discarded after 24 hours.
To keep your visits out of our counts, open a page with ?analytics=off at the end of its address. That sets the one cookie named for it in the table above.
3. A bot check, address suggestions and a booking calendar
- A bot check. The form that builds a demo and the form that asks for a setup call load a bot check from Cloudflare, called Turnstile. Cloudflare says it uses what it collects to tell people from bots, and not to identify, profile or target anyone.
- Address suggestions. Inside the signed in dashboard, an address field loads suggestions from Google.
- A booking calendar. After you enter your details at dm-desk.com/book, the page shows Calendly's booking calendar inside it. That calendar is Calendly's own page, and this notice does not cover what it keeps in your browser.
Each runs under its own terms. All three companies are on our Subprocessors page.
4. The chat on a business's website
A business that uses DM DESK can put our chat on its own website. The chat sets no cookies. It keeps the items below in the browser's storage for that website.
A link that a business sends you in an Instagram conversation can carry a code. If you open the business's website from that link, the chat can continue that conversation there. For that it keeps the code and a mark, and it uses the visitor ID. All three are in the table.
Scroll the table sideways to see what each one holds and how long it stays.
| Name and kind | When it is set | What it holds | How long it stays |
|---|---|---|---|
| dmdesk_visitor_(business id)Local storage | When the chat first loads on the website, before it is opened. | A random visitor ID, so the same conversation continues across pages. | The chat does not remove it. |
| dmdesk_seen_(business id)Local storage | When the chat loads, unless it already holds that day's date. Not on a page the chat finds to be a Square Online store, and not on a page that loads the chat as a demo. | The day's date, so the chat reports that it is installed once a day and not on every page. | Written over on the next day the chat loads. Removed when the chat reads, in the answer to its report, that it is refused on that website. Otherwise the chat does not remove it. |
| dmdesk_fresh_after_(business id)Local storage | When you start a new chat. | The ID of the conversation you left. | Removed when the next conversation starts. |
| dmdesk_voice_mutedLocal storage | When you tap the mute button. | Whether spoken replies are muted. | The chat does not remove it. |
| dmdw_ticks_(business id)_(visitor id)Local storage | When you tick a line of an order checklist. | The lines you ticked: quantity, item and note. | The chat does not remove it. |
| dmdesk_teaser_off_(business id)Local storage | When you close the greeting bubble. | The time you closed it. | The chat does not remove it. Used for 7 days, then ignored. |
| dmdesk_teaser_seen_(business id)dmdesk_teaser_cfg_(business id)Session storage | When the chat gets the greeting's settings from DM DESK, when the greeting bubble is shown or closed, and when the chat opens. | A mark not to show the greeting again in this tab, and the greeting's settings. | The chat does not remove them. |
| dmdesk_sqo_pingSession storage | On a Square Online store, once a visit. | A mark that the chat tried to tell DM DESK it is on this store. | The chat does not remove it. |
| dmdesk_cart_done_(cart id)Session storage | When a page is opened from a DM DESK cart link. | A mark, so the order is not added twice. | The chat does not remove it. |
| dmdesk_dmd_(business id)Session storage | When you open the website from a link with a code in it. A business can send such a link in an Instagram conversation. | The code from that link. The chat takes it out of the page's address as soon as the chat loads. | Removed when the chat has sent the code to DM DESK and read the answer. |
| dmdesk_joined_(business id)Local storage | When the chat has accepted that code. | A mark that the chat accepted that code. The chat reads it to continue an Instagram conversation. | Removed when the chat finds that it continues no Instagram conversation here, which it checks when it is opened. Otherwise the chat does not remove it. |
| dmdesk_teaser_probeLocal and session storage | When the chat tests that storage works. | A test value. | Removed at once. |
On a Square Online store, the chat reads one of that store's own cookies and sends it only back to the store, to add your order to the store's cart.
Our Privacy Policy covers the messages you send in the chat.
5. Your choices
Clearing the sign in cookie signs you out. After you clear the chat's storage on a website, the chat makes a new visitor ID the next time it loads there.
6. Contact
Questions about this notice: email privacy@dm-desk.com.
DM DESK is operated by DM Desk LLC, a California limited liability company. See also our Privacy Policy and Security pages.