diff --git a/server.js b/server.js
index e82b1ba..abbf431 100644
--- a/server.js
+++ b/server.js
@@ -418,7 +418,13 @@ const server = http.createServer(async (req, res) => {
       } catch (e) { return json(res, 200, { found: false, rpcError: true }); }
     }
     if (p === '/api/sponsor' && req.method === 'GET') {
-      const tok = parseCookies(req)['iap.sponsor'] || '';
+      // The account's stored sponsor is authoritative — it persists across
+      // devices, cleared cookies, and return visits. Fall back to the first-touch
+      // cookie only for anonymous visitors with no account sponsor yet. (Reading
+      // the cookie alone was orphaning buyers to root when the cookie was absent.)
+      const s = await auth.fromRequest(req);
+      const acct = s && s.email ? await accounts.byEmail(s.email) : null;
+      const tok = (acct && acct.sponsorRef) || parseCookies(req)['iap.sponsor'] || '';
       const sponsorId = await resolveSponsorToken(tok);
       let name = null, avatarUrl = null;
       if (tok) {