The cookies we do use
| Cookie | Set when | Purpose | Lasts |
|---|---|---|---|
| Sign-in refresh token | You sign in to the dashboard | Keeps you signed in. HttpOnly, Secure, SameSite=Strict, sent only to our sign-in endpoint | Until you sign out or it expires |
| AWS WAF CAPTCHA token | You complete a human check on a form | Proves the check was passed, to stop automated abuse | Short-lived |
Both are strictly necessary, so they don’t need consent.
What we don’t use
- No analytics cookies. Page views are counted from our own server logs.
- No advertising or retargeting cookies or pixels.
- No cookies on
sfqr.linkor customers’ domains, so scanning a code never sets one.
Session storage
If you arrive from a Google ad, the ad’s click ID is kept in your browser’s session storage until you close the tab, and sent with an order so we can report the purchase to Google Ads. See our privacy notice.