Cookie Policy

Cookies We Use

Every cookie here is set by this site, is httpOnly (the page's own scripts cannot read it) and is only sent back to us. Where a name has <company> in it, that part is your company's page address, so each company's page gets its own cookie.

On your company's page

• showcase_unlock_<company>

  Set when you type your company's page password, so you do not have to type it on every visit. It holds a hash, never the password.

  Lasts: 90 days, renewed on each visit · Strictly necessary: Yes

• us_approver_<company>

  Set when you add your name to approve cards, so your decisions stay under your name when you come back.

  Lasts: 400 days · Strictly necessary: Yes

• us-prospect

  Set when a company starts an order on our sign-up page, so the later steps can only act on the company that browser created. The sign-up page is not open to the public yet.

  Lasts: 7 days · Strictly necessary: Yes

When you sign in with Google

Signing in is optional, and the password link works without it. These are only set if you choose it.

• __Secure-authjs.session-token

  Keeps you signed in. Encrypted; it holds your account ID and the name and email address Google sent us. Not your picture. Deleted when you sign out.

  Lasts: 30 days · Strictly necessary: Yes

• __Host-authjs.csrf-token

  Stops another site from signing you in or out without you asking.

  Lasts: Until you close your browser · Strictly necessary: Yes

• __Secure-authjs.callback-url

  Remembers which page to bring you back to after Google.

  Lasts: Until you close your browser · Strictly necessary: Yes

• __Secure-authjs.pkce.code_verifier

  A one-off check that the answer coming back from Google belongs to the sign-in you started.

  Lasts: 15 minutes · Strictly necessary: Yes

Our own team only

Customers never get these. They are listed so the page is complete.

• unicorn-auth

  Keeps our own team signed in to the admin side of the site (httpOnly, signed).

  Lasts: 30 days · Strictly necessary: Yes

• us_view_as_act

  Lets one of our team make changes on a customer's page while on a call with them, recorded under our name and not the customer's.

  Lasts: 2 hours · Strictly necessary: Yes

Stored in your browser, not cookies

A few pages also keep small notes in your browser's own storage. These never leave your device and we cannot read them. Our admin pages keep a few working notes in our own team's browsers too. Customers never get these.

• us:meet:<company>:section

  us:walk:<company>:step

  Puts you back on the section or step you were last reading.

  Lasts: Until you clear it · Strictly necessary: Yes

• us:pack-opening:<company>:seen

  us:open-first:<company>

  Remembers that you have already opened your pack, so the page does not make you open it again.

  Lasts: Until you clear it · Strictly necessary: Yes

Third-Party Cookies

We set no third-party cookies and run no advertising or tracking technologies. We do use Vercel Analytics, which counts page views without setting a cookie and without building a profile of you. If you sign in with Google, Google sets its own cookies on its own sign-in pages; its privacy policy covers those.

Consent

Under the UK Privacy and Electronic Communications Regulations (PECR), cookies and other notes stored in your browser that are strictly necessary for something you asked for do not need consent. Every cookie and stored item on this page is one of those, which is why there is no cookie banner.

Managing Cookies

You can delete cookies at any time through your browser settings. Deleting the password cookie means typing your company's page password again. Deleting the Google cookies signs you out, and signing out from the approval page deletes the session cookie for you.

Contact

For questions about our use of cookies, contact us at george@unicorn-status.com.