Loading...
Please wait while we prepare your content
Loading...
Please wait while we prepare your content
Last updated: 2026-11-04
This page lists the cookies Collabkick sets, and the cookies Stripe and Google Analytics set when those services run. It supplements the Privacy Policy. Cookies set by Collabkick use SameSite=Lax and apply only to this site.
Questions about these cookies: contact@collabkick.com
These cookies remember your language and region, keep you signed in, and protect sign-in. They are not used for advertising. The cookie banner cannot turn them off. No expiry is stored on the session cookies: the browser deletes them when the session ends. Sign-in cookies are httpOnly, so page scripts cannot read them.
| Cookie | Purpose | Duration |
|---|---|---|
lang | Remembers the interface language chosen in the language menu or with a lang parameter. | Browser session |
region | Remembers the region used for pricing and regional content, chosen in the region menu or with a region parameter. | Browser session |
authjs.session-tokenOn HTTPS: __Secure-authjs.session-token | Keeps you signed in. The cookie lasts 7 days and is renewed at most once a day. An admin session ends after 12 hours even if the cookie is still stored. A large token is split into names ending in .0, .1, and so on, with the same duration. | 7 days |
authjs.csrf-tokenOn HTTPS: __Host-authjs.csrf-token | Protects sign-in and other authentication requests against cross-site request forgery. | Browser session |
authjs.callback-urlOn HTTPS: __Secure-authjs.callback-url | Remembers which page to open after you sign in. | Browser session |
authjs.pkce.code_verifierOn HTTPS: __Secure-authjs.pkce.code_verifier | Completes sign-in with Google, Facebook, or Apple. Present only during that sign-in. | 15 minutes |
authjs.stateOn HTTPS: __Secure-authjs.state | Ties the response from Google, Facebook, or Apple to the sign-in that started it. Present only during that sign-in. | 15 minutes |
authjs.nonceOn HTTPS: __Secure-authjs.nonce | Checks the identity token returned by Google, Facebook, or Apple. Present only during that sign-in. | Browser session |
referral_code | Ties a later sign-up to a referral code. Set only when referrals are enabled and the link contains a ref code. Page scripts cannot read it. | 90 days |
ff_* | Remembers a product experiment for this browser. Set only when a feature parameter is used. Names: ff_i18n_plus, ff_my_creators, ff_search, ff_marketplace_discovery, ff_proposals, ff_social_proof, ff_testimonials, ff_referral. | Browser session |
Stripe.js sets these cookies when a payment, card authorization, or Stripe Connect form is loaded, to prevent fraud. Collabkick does not set them. Stripe also sets them on its own domains, including checkout.stripe.com and link.com.
| Cookie | Purpose | Duration |
|---|---|---|
__stripe_mid | Lets Stripe assess the risk of a payment attempt. | 1 year |
__stripe_sid | Lets Stripe assess the risk of a payment attempt during the current visit. | 30 minutes |
Google Analytics 4 loads only after you accept analytics in the cookie banner. Until then these cookies are not set. Vercel Web Analytics loads at the same time and does not set a cookie. Sentry error monitoring does not set a cookie. Session replay starts only after analytics consent, with text masked, and is configured not to send cookies.
| Cookie | Purpose | Duration |
|---|---|---|
_ga | Distinguishes browsers for Google Analytics 4 (G-3KYM3Y8J4Q). Set only after you accept analytics. IP anonymization is on. | 2 years |
_ga_3KYM3Y8J4Q | Stores Google Analytics 4 session state for G-3KYM3Y8J4Q. Set only after you accept analytics. | 2 years |
The cookie banner stores your choice in this browser's local storage, under the key cookie_consent, not in a cookie. It stays until you clear site data for Collabkick. Analytics and marketing stay off until you turn them on. The banner also has a functionality preference, and that preference does not set an extra cookie. Language and region cookies are essential and are set when you choose a language or region.
The marketing preference does not load an advertising tag. It only updates the advertising consent signals sent to Google Analytics when analytics is also accepted.