This policy and our operator
This website (XICO Store, at store.xicoai.com, referred to below as “the store”) is operated by 智希可科技（广州）有限公司 (referred to below as “we” or “us”). This policy explains how we use cookies and similar browser storage technologies to provide product browsing, a shopping cart, checkout and payment redirects, account login, digital delivery, security and optional anonymous analytics.
This policy forms part of our Privacy Policy. Terms not specifically explained here, your personal information rights and our arrangements for joint and entrusted processing are governed by the Privacy Policy. If the two policies conflict, this policy takes precedence on cookie matters.
This policy applies to the web version of the store. After you are redirected from the store to a payment provider or another third-party website, that site sets its own cookies under its own policies. See “Third-party cookies and services” below for details.
What cookies and similar technologies are
A cookie is a small piece of text data sent by a website when you visit it and stored on your device by your browser. The browser sends it back to the same site with later requests, allowing the site to recognize the browser’s state across pages, such as whether you are logged in or which theme you chose. Cookies are text: they cannot run programs or read other files on your device.
In this policy, “cookies” also includes the following technologies that serve similar purposes in your browser:
- Local storage (localStorage): data stored in the browser that is not automatically sent to the server with requests. The store uses it to save cart contents and theme preferences.
- Session storage (sessionStorage): similar to local storage, but cleared when the tab is closed.
The store does not use cross-site tracking pixels, device fingerprinting, third-party data matching or any technology that links your browsing activity to third-party advertising identifiers.
Why we use cookies
We use cookies only for the following four purposes:
- Keeping the store working: keeping you signed in, saving your shopping bag, and maintaining the same session between checkout and payment redirects.
- Protecting security: detecting and blocking credential stuffing, brute-force attacks, replay attacks, and automated abuse to protect the administration area and your account.
- Remembering your choices: your light or dark theme preference and the cookie choice you make on this page.
- Understanding page usability (optional): after you consent, collecting anonymous statistics on page stability and ease of use to prioritize improvements.
We do not use cookies to analyze your personal characteristics, make automated decisions about you that have legal or other significant effects, or set personalized prices.
Cookie categories
The store's cookies fall into three categories. Your choice affects only the third; the first two are necessary to provide services you actively request and cannot be disabled.
- Strictly necessary (always on): without these, sign-in, the shopping bag, checkout, digital delivery, and security protection cannot work. These cookies do not require your consent, but we still list each one below.
- Functionality and preferences (always on): saving the choices you make in the interface. There are very few of these, and they contain no information that could identify you.
- Analytics (optional, off by default): set only after you select “Accept all cookies,” with consent that you can withdraw at any time. Refusing does not affect browsing, ordering, payment, downloads, or any account feature.
Advertising and marketing cookies: this store does not currently use them. See the “Advertising and marketing” section below for details.
Strictly necessary cookie register
The following cookies are set by this store on its own domain (first-party). All have Secure and HttpOnly, so page scripts cannot read them; the SameSite attribute limits when they are sent across sites.
| Name | Purpose | Attributes | Lifetime |
|---|---|---|---|
| xico_store_session | Maintains customer sign-in and access to purchased resources | First-party · HttpOnly · Secure · SameSite=Lax | Up to 1 year; the server session may expire sooner, and the cookie is cleared on sign-out |
| xico_store_admin | Maintains a protected administration session for store staff only | First-party · HttpOnly · Secure · SameSite=Strict | Up to 12 hours |
| xico_admin_captcha | Binds a one-time administration security check to prevent automated sign-in attempts | First-party · HttpOnly · Secure · SameSite=Strict · /admin path only | 120 seconds |
Functionality and preference storage register
The following items save the choices you make in the interface. Some need to be read by page scripts, for example to apply the dark theme before the first screen is drawn, so they do not have HttpOnly; they contain no identity information and are not used to identify you.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
| xico_store_consent | Cookie | Records your own cookie choice so we do not ask again and can determine whether to set optional cookies | 1 year |
| xico_store_locale | Cookie | Remembers the storefront language for pages and checkout. A necessary functional preference, not used for marketing | 1 year |
| xico_store_theme | Cookie | Saves the light, dark, or system theme preference for the server's initial page rendering | 1 year |
| xico-store-theme | Local storage | Same preference as above, read synchronously by the browser before drawing the page to prevent theme flicker | Until you clear browser data |
| xico-store-cart-v1 | Local storage | Saves the products and quantities in your shopping bag so you can resume checkout after refreshing or closing the page | Until you empty your shopping bag or clear browser data |
Optional analytics cookie register
The following cookie is set only after you explicitly select “Accept all cookies”. Before you make a choice, and after you select “Use necessary cookies only” or withdraw consent, it is not created. The related analytics endpoints also return an empty response without recording anything.
| Name | Purpose | Attributes | Lifetime |
|---|---|---|---|
| xico_store_anon | First-party anonymous visit statistics: distinguishes repeat visits from the same browser to measure page views and feature usage | First-party · HttpOnly · Secure · SameSite=Lax | Up to 1 year |
These analytics are implemented entirely by us. The data stays on the store's servers and is not shared with any advertising company or data broker. The server does not store the cookie's raw value. Instead, it stores a one-way digest made with a separately held key and retains only the necessary page-event fields. We never save your email address, account ID, order contents, payment information, raw IP address, or any private token in analytics data.
Advertising and marketing
This store currently displays no advertising and sets no advertising or marketing cookies.We do not use advertising identifiers, engage in cross-site behavioral targeting, or share or sell your personal information to advertising networks or data brokers.
Our system retains the ability to display ads in the future, but it is disabled in this deployment and designed to stay disabled when configuration is missing. If we enable advertising in the future, we will first update this policy, ask for your consent again, and add the relevant third-party cookie register to this page. Even then, checkout, shopping bag, order, account, sign-in, and administration pages will remain free of advertising.
Third-party cookies and services
The store's pages do not embed any third-party tracking scripts; every item in the three registers above is first-party. Third parties cannot read your browsing activity on the store's pages.
Completing payment does require leaving this store: when you choose Alipay, WeChat Pay, or a bank card processed by Stripe, your browser redirects to the payment provider's page or opens its app. On those pages, the provider uses its own domain to set its own cookies for risk management, fraud prevention, and payment processing. The provider independently controls these cookies; we cannot read or delete them, and their use is governed by the provider's own privacy and cookie policies. When you return to this store after payment, we receive the provider's payment-result notification, not its cookies.
The store's content delivery network is used only to deliver our own static resources, not for user profiling.
Processing purposes and legal basis
We process personal information related to cookies on the following bases:
- Strictly necessary and preference cookies: necessary to enter into and perform a contract to which you are a party, meet statutory obligations, and safeguard network and transaction security. The basis is Article 13, paragraph 1, items (2) and (3) of China's Personal Information Protection Law. Where the General Data Protection Regulation (GDPR) applies, the corresponding provisions are Articles 6(1)(b) and 6(1)(f). These cookies are strictly necessary to provide a service the user understands and expressly requests, so prior consent is not required under Article 5(3) of the ePrivacy Directive.
- Optional analytics cookies: based on your separate, explicit consent. The basis is Article 13, paragraph 1, item (1) and Article 14 of China's Personal Information Protection Law, corresponding to Article 6(1)(a) of the GDPR and Article 5(3) of the ePrivacy Directive. You may withdraw consent at any time; withdrawal does not affect the validity of processing carried out before it.
We do not treat continued browsing as consent, and accepting optional cookies is not a condition of using this store.
Storage location and cross-border transfers
The store's servers and databases are located in the People's Republic of China. Server-side records associated with the first-party cookies listed above are stored there.
If you choose bank-card payment processed by Stripe, the payment takes place in Stripe's systems outside China. Stripe processes the payment information you submit on its pages as an independent personal information processor. We do not receive or store your full card number, expiry date, or security code. For the purpose and scope of this cross-border processing and your rights, see our Privacy Policy and Stripe's own privacy policy.
Retention periods and expiry
Each item's lifetime is listed above. In addition to automatic expiry, the following may end its validity sooner: signing out, which clears the sign-in cookie and invalidates the server session; withdrawing cookie consent, which stops the creation of optional cookies; our detection of an account or administration security risk, which forces the session to expire; or deleting this site's data in your browser.
Transaction and invoice records that must be retained by law are kept by the order system for the statutory period, independently of any optional cookies. Deleting cookies does not and cannot delete these statutory records.
Security measures
We apply the following measures to cookies and their associated server-side state: mandatory HTTPS encryption across the site; all session and security cookies use HttpOnly, Secure and an appropriate SameSite; administration cookies are restricted to the /admin path and use SameSite=Strict; tokens are stored as salted one-way digests; analytics identifiers use a one-way digest with a separate key; a Content Security Policy (CSP) and a per-request script nonce reduce script-injection risks; administration uses separated permissions and action auditing.
Session tokens and security cookies are never written into page HTML, included in analytics events, passed in URL parameters, or saved to storage accessible by page scripts.
Your choice: accept, refuse, and withdraw
On your first visit to the store, you will see a cookie choice panel. Its two options appear side by side, are equally prominent, and are equally easy to click:
- Accept all cookies: allows us to set the optional analytics cookie listed above in addition to necessary cookies.
- Essential cookies only: keeps only the items necessary to run the store. This choice does not restrict browsing, ordering, payment, downloads, or any account feature, and does not cause the panel to appear repeatedly.
Whatever you choose, we record the choice itself in xico_store_consent so we do not disturb you again. No optional cookie is set before you make a choice.
You can change your mind at any time: click “Cookie settings” at the bottom of the page to reopen the panel and select the other option. Once you withdraw consent, we immediately stop creating and using optional analytics cookies. Previously generated aggregate statistics that can no longer identify an individual are not retroactively restored to personal information by withdrawal. You can also delete the following cookie directly in your browser: xico_store_anon.
Manage cookies in your browser and on your device
In addition to this store’s cookie settings, your browser lets you view, block or delete cookies and local storage, usually on a per-site basis:
- Chrome / Edge: Settings → Privacy and security → Third-party cookies (or Cookies and other site data)
- Safari (macOS): Settings → Privacy → Manage Website Data; Safari (iOS): Settings → Safari → Advanced → Website Data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- In-app browsers in WeChat, Alipay and similar apps: follow the app’s settings to clear stored data
Please note: deleting or blocking essential cookies signs you out, empties the shopping bag in your browser, resets your theme and cookie choices, and brings up the panel again. In an incognito or private window, all data stored by this site is cleared when the window closes. You can still browse public pages.
Do Not Track and Global Privacy Control signals
There is no uniform industry standard for the Do Not Track (DNT) request header, and the scope of Global Privacy Control (GPC) signals varies by jurisdiction. This store therefore does not respond separately to either signal.
We state this here to describe our practices accurately, rather than claim support we have not implemented. The activities these signals aim to prevent—cross-site tracking and ad targeting without consent—do not occur in this store. We do not run ads or embed third-party tracking scripts, and our only optional cookie is never set before you explicitly click “Accept all cookies”. If we introduce advertising or third-party analytics in future, this section will explain how we respond to these signals at that time.
Minors
This store provides digital products to adult users. We do not intentionally set optional cookies for minors or knowingly collect personal information from children under 14. If you are a minor’s guardian and discover that they have provided personal information to this store without your consent, contact us at the email address below. After verification, we will delete the relevant information and revoke the associated optional cookies.
Policy updates
If there is a material change to cookie categories, names, purposes, durations, providers or how we provide our services, we will update this policy and the effective date at the top of the page. Before any change that adds optional cookies or third parties takes effect, we will ask for your consent again. Your previous choice will not automatically count as consent to a new purpose. We recommend revisiting this page from time to time.
Contact and complaints
For questions about this policy or your cookie choices, or requests for access, copies, correction, deletion or withdrawal of consent, email hi@xicoai.com; after verifying your identity and the validity of the request, we will respond promptly, usually within 15 business days. Company details and our contact address can be found here: Company website xicoai.com.
If you believe our processing of personal information infringes your rights and interests, and you are dissatisfied with our response, you have the right to lodge a complaint or report with the authorities responsible for personal information protection, or bring an action before a people’s court in accordance with the law.