How identity stitching works
The visitor ID
Section titled “The visitor ID”The first time someone lands on your storefront, Máximo assigns their browser a visitor ID and stores it in a first-party cookie. That ID is what ties their browsing activity (page views, product views, cart activity) together across a session and, as long as the cookie survives, across return visits on the same browser.
On its own, a visitor ID only identifies a browser, not a person. Identity stitching is what upgrades that into a record of a person once Máximo has evidence to do so.
Identifiers Máximo collects
Section titled “Identifiers Máximo collects”As a shopper moves through your storefront and checkout, Máximo collects several kinds of identifiers alongside each event:
- Hashed email and hashed phone, when the shopper provides them at checkout.
- Shopify customer ID and order ID, when the checkout is tied to a customer account or produces an order.
- Ad-platform identifiers like a GA4 client ID or Meta’s
_fbpbrowser cookie, captured passively as the shopper browses.
Strong identifiers merge, weak identifiers don’t
Section titled “Strong identifiers merge, weak identifiers don’t”Not every identifier is treated the same way, because not every identifier is equally trustworthy evidence that two sessions belong to the same person:
Strong identifiers: hashed email, hashed phone, Shopify customer ID, and Shopify order ID, are allowed to merge records together. If a returning shopper’s session shares one of these with an existing record, Máximo links the two into the same identity.
Weak identifiers: like a GA4 client ID or an _fbp value, are recorded and stored alongside a person’s record once it exists, but they never trigger a merge on their own. A shared browser-generated ID isn’t strong enough evidence that two sessions are the same shopper; it’s exactly the kind of value that can coincidentally repeat or get reset, reused, or shared across devices in ways that don’t reflect one real person.
This distinction exists specifically to protect against wrongly merging two different people into one identity. Getting that wrong is worse than not merging at all, it would corrupt attribution and could send one person’s data into another’s record. Requiring strong evidence (something the shopper actually entered, like an email, or something Shopify itself generated, like an order) keeps merges reliable, at the cost of occasionally leaving two sessions from the same person unlinked when no strong identifier was ever shared between them.