Cookie Policy

This Cookie Policy explains how Keypra uses cookies, localStorage, and similar client-side technologies when you visit or use the Service. For simplicity, this page refers to these technologies together as "cookies and similar technologies."

Keypra uses a limited set of strictly necessary technologies to run the Service securely and to remember basic user choices. Keypra also offers optional analytics and marketing settings that remain off until you choose to enable them.

Keypra does not use browser fingerprinting. Keypra does use four named third-party technologies: Google Analytics 4 for aggregate audience measurement (described in Section 4 below, gated behind Analytics consent), and the Google Ads conversion tag, the LinkedIn Insight Tag, and the X (Twitter) Pixel for advertising measurement (described in Section 5 below, gated behind Marketing consent). None of them load, and none of their cookies are set, unless you grant the matching consent — and all four are hard-disabled for California visitors and anyone sending the Global Privacy Control signal.

Keypra currently uses the following categories of cookies and similar technologies:

Name / category	Provider	Purpose	Necessary
sb-*-auth-token	Keypra / Supabase	Maintains the signed-in session and related authentication state	Yes
theme	Keypra	Remembers the visitor's display preference, such as light or dark mode	Yes
cookie_consent	Keypra	Records the visitor's cookie category choices only — saved whether you accept or reject, never used for tracking or profiling	Yes
cf_clearance, __cf_bm	Cloudflare (infrastructure provider)	Bot-mitigation challenge token issued by our infrastructure provider	Yes
__stripe_mid, __stripe_sid	Stripe (third-party)	Fraud prevention on the checkout page only	Yes
Google Analytics 4 (gtag.js, G-Y8FE3QV5RG)	Google Ireland Ltd / Google LLC	Aggregate audience measurement: page views, sessions, traffic sources, approximate region	No — Analytics consent required
Google Ads tag (gtag.js, AW-18144700120)	Google Ireland Ltd / Google LLC	Conversion tracking for paid-search and display campaigns	No — Marketing consent required
LinkedIn Insight Tag (Partner ID 10229937)	LinkedIn Ireland Unlimited Company	Conversion tracking and reporting for LinkedIn ad campaigns	No — Marketing consent required
X (Twitter) Pixel (ID rcjxd)	X (Twitter International Unlimited Company)	Conversion tracking and reporting for X ad campaigns	No — Marketing consent required

Storage type	Duration
localStorage and/or session storage used by the authentication client	Until sign-out, session termination, or token rotation
localStorage (theme)	Until changed or cleared by the user
localStorage (cookie_consent)	6 months, unless changed earlier
Cloudflare cookies (cf_clearance, __cf_bm)	30 minutes – 1 year
Stripe cookies (__stripe_mid, __stripe_sid)	1 year / 30 minutes
Server-side consent records	Up to 12 months from the relevant consent event, unless renewed, withdrawn, or deleted earlier
Google Analytics cookies (_ga, _ga_*)	13 months, only set once Analytics consent is granted; cleared immediately on withdrawal
LinkedIn cookies (li_gc, lidc, bcookie, bscookie, UserMatchHistory, AnalyticsSyncHistory)	Up to 13 months, only set once Marketing consent is granted; cleared immediately on withdrawal
X cookies (_twclid, personalization_id, muc_ads)	Up to 13 months, only set once Marketing consent is granted; cleared immediately on withdrawal
First-party page-engagement visit identifier (keypra_anon_id)	Up to 13 months; created only after Analytics consent and deleted on withdrawal
Flock session identifier (session-id)	30 minutes; created only after Analytics consent and cleared on withdrawal

Analytics cookies

Name	Provider	Purpose	Duration	Category
_ga, _ga_*	Google Ireland Ltd	Google Analytics 4 aggregate audience measurement	13 months	Analytics

Ad measurement cookies

Name	Provider	Purpose	Duration	Category
_gcl_au, _gcl_aw, _gcl_gb	Google Ireland Ltd	Conversion measurement (_gcl_aw stores gclid; _gcl_gb stores gbraid/wbraid)	90 days	Marketing
keypra_twclid	Keypra (first-party)	Keeps the X click ID after consent; before consent it is held in memory for that browser tab only, then stored in a cookie and sessionStorage after consent, and cleared on withdrawal	30 days	Marketing

ad_storage, ad_user_data and ad_personalization are Google Consent Mode signals, not cookies.

X may also receive server-side conversion events (Conversion API): for email-lane signups these carry only the conversion type and timestamp; for web signups the stored click ID is included only when Marketing consent was granted.

No optional analytics or marketing technologies are activated before the user chooses to enable them. Before consent, the only advertising-related code on the page is a small Google Consent Mode v2 signal that sets every advertising and analytics storage permission to denied; it loads no third-party script and sets no cookie. The Google Ads tag, Google Analytics 4, the LinkedIn Insight Tag and the X (Twitter) Pixel are each downloaded only after the matching consent is granted, and are removed again when it is withdrawn.

Our own first-party measurement follows the same rule. The site-performance and page-view script served from this domain (/~flock.js, which reports to /~api/analytics and may set a session-id identifier for 30 minutes) and our page-engagement measurement (a visit identifier in local storage kept for up to 13 months, time on page and scroll depth) are both loaded only after Analytics consent. Withdrawing Analytics consent stops them and clears the identifiers they created.

Category	Required for service	What it covers
Necessary	Yes	Authentication, security, session continuity, consent recordkeeping, and basic interface preferences
Analytics	No	Behavioral telemetry, competence and retention measurement, product analytics, and documentation analytics used to improve the Service
Marketing	No	Marketing / Ad measurement: with your consent, Google Ads, LinkedIn and X measure whether our ads led to a visit, a sign-up or a purchase and, for Google Ads, a request for the email guide or a click on our email address. Details per partner are in Section 5 below. Keypra uses this only for ad measurement. Google, LinkedIn and X may also process this data as controllers under their own privacy policies and your settings with them.

Necessary technologies cannot be switched off because the Service would not function properly without them.

Analytics and Marketing are optional and remain disabled unless you give consent.

If you enable Analytics, Keypra may process first-party usage and learning-improvement data such as feature usage events, documentation page visits, behavioral telemetry connected to prompt-crafting activity, and competence or retention signals used to improve the learning experience.

Enabling Analytics also activates Google Analytics 4 (gtag.js, measurement ID G-Y8FE3QV5RG, operated by Google Ireland Ltd / Google LLC), which Keypra uses for aggregate audience measurement — page views, sessions, traffic sources, approximate country/region, and non-identifying product-event counts. It sets the _ga and _ga_* cookies (13 months).

Google Analytics 4 measurement data is treated as personal data under our Privacy Policy (see Privacy Policy Section 8a, "When Data Stops Being Personal Data"); the safeguards below reduce the data collected but do not make it anonymous.

Safeguards applied to Google Analytics 4: Google Analytics 4 does not log or store IP addresses; Google Signals is switched off on the property and the property is not linked to Google Ads; granular location and device data collection is off; event and user data is retained for 2 months before Google deletes it; and Keypra never sends user IDs, e-mail addresses, prompt content, document content or organisation names to Google Analytics. Withdrawing Analytics consent removes the script and clears the _ga / _ga_* cookies immediately. Google Analytics is also hard-disabled for California visitors and any browser sending the Global Privacy Control (GPC) signal, regardless of your Analytics-cookie choice.

Apart from Google Analytics 4, these analytics activities are designed as first-party product and learning analytics. Keypra does not use third-party advertising cookies for this purpose.

Where analytics data is linked to your account, you can later review or change the relevant settings in your account privacy controls.

If you enable Marketing (ad measurement), Keypra activates three named third-party advertising technologies, which Keypra uses only to measure whether our ads led to a visit, a sign-up or a purchase and, for Google Ads, a request for the email guide or a click on our email address:

• Google Ads conversion tag (gtag.js, account AW-18144700120, operated by Google Ireland Ltd / Google LLC) — records visits, sign-ups, purchases, email-guide requests and email-address clicks by consenting visitors so that Google Ads can report whether they had clicked or seen a Keypra advert.
• LinkedIn Insight Tag (Partner ID 10229937, operated by LinkedIn Ireland Unlimited Company) — records visits and purchases by consenting visitors so that LinkedIn can report whether they had clicked or seen a Keypra advert.
• X (Twitter) Pixel (ID rcjxd, operated by X (Twitter International Unlimited Company)) — records visits, sign-ups and purchases by consenting visitors so that X can report whether they had clicked or seen a Keypra advert.

Google click identifiers (gclid, gbraid, wbraid) are read from the address you arrive on, kept only in your browser, and shared with Google Ads only after you accept Ad measurement. Keypra does not store them on its servers. If you withdraw consent, we delete these cookies.

None of these three technologies load, and none of their cookies are set, until you grant Marketing consent. Withdrawing Marketing consent removes the Google Ads, LinkedIn and X scripts, deletes their cookies immediately (including the Google Ads _gcl_* cookies), and denies Google Ads advertising storage going forward. California residents and any browser sending the Global Privacy Control (GPC) signal: all three technologies are hard-disabled regardless of your Marketing-cookie choice — see the Privacy Policy §16.3.

Keypra does not use these technologies to build retargeting or lookalike audiences, and does not use any other third-party advertising network, retargeting pixel or cross-site advertising tracker beyond the three named above. Full vendor detail, the categories of data received by each provider, and the international-transfer safeguards that apply are published on the Sub-Processors page (§2a).

You can withdraw Marketing consent at any time via Cookie Settings in the site footer or on this page.

Keypra relies on service providers to operate parts of the Service, including authentication, infrastructure, hosting, communications, and AI functionality.

Where a third-party provider is involved in data processing connected to the Service, the relevant provider details and transfer information are described in the Privacy Policy and Sub-Processors page.

For current provider information, see:

• Privacy Policy
• Sub-Processors

You can manage your preferences in the following ways:

• From the cookie banner when you first visit the Service.
• At any time through the Cookie Policy preference controls on this page.
• If you have an account, through Settings → Privacy for account-level consent management and data controls.
• Through your browser controls, including clearing localStorage or stored site data.

Withdrawing consent is as easy as giving it. If you withdraw consent, Keypra will stop using the relevant optional technologies on a going-forward basis. Withdrawal does not affect processing that took place before the withdrawal.

Keypra keeps strictly necessary authentication-related storage only for as long as needed to maintain the session and secure access to the Service.

Preference records for cookie_consent are kept for up to 6 months unless changed earlier.

Server-side records showing whether optional consent was granted or withdrawn are kept for no longer than necessary to demonstrate and manage the relevant choice, ordinarily within a 12-month consent cycle unless a shorter period is required by a later implementation update or a user exercises deletion rights.

Where optional analytics or marketing data is collected after consent, the retention of that data is governed by the Privacy Policy and the relevant internal retention schedule for that category.

Keypra may update this Cookie Policy when technologies, purposes, service providers, or legal requirements change.

If a change materially affects optional technologies or the purposes for which they are used, Keypra will ask for fresh consent before enabling the new optional processing.

Continued browsing alone will not be treated as consent for new optional cookies or similar technologies.

For questions about this Cookie Policy or your privacy choices, contact:

Email: privacy@keypra.com

Privacy Policy: /privacy

For the current controller and provider details, please also consult the Privacy Policy and Sub-Processors page.