Cookie Policy

Cookies are small pieces of data stored in your browser. QuikRing uses very few of them — only what's needed to keep you signed in, keep the service secure, and understand how the product is used (see "Your cookie choice" below for when we ask first).

Separately, every page view on our public site is counted in an anonymous daily aggregate (page, referrer, language, country, device) with no cookie and no identifier stored with it. Your IP address is used only for a one-minute limit on how many page views one connection can report, and that record is deleted within a day — this isn't a cookie and runs regardless of your choice below.

Cloudflare, which delivers our website, also counts page visits and measures how fast pages load with its Web Analytics script. It sets no cookie and stores nothing on your device, and it also runs regardless of your choice below.

These are set on quikring.com whatever you choose in the cookie banner, because sign-in, security and fraud prevention need them. None is used for advertising. Only the device signal below is shared, with Stripe, to check a payment for fraud.

• Session cookie (__Secure-authjs.session-token) — a signed, HTTP-only cookie that keeps you signed in between page loads. Set when you sign in and removed when you log out; a sign-in lasts at most 7 days, or 12 hours if you untick "Keep me signed in".
• CSRF protection cookie (__Host-authjs.csrf-token) — set on every visit, signed in or not, to protect sign-in and account actions against cross-site request forgery. Deleted when you close your browser.
• Sign-in return page (__Secure-authjs.callback-url) — set on every visit to remember which page to bring you back to after you sign in. When you sign in with Google or Microsoft, it also holds, until you are back, the code of an affiliate partner whose link brought you in on this visit, so the partner is credited if you sign up; with the optional cookies on, also how you reached our site (campaign tags, first page, referring site) and the country of a number you typed. Deleted when you close your browser.
• Device signal for fraud prevention (wp-fp) — on the sign-up and sign-in pages, a device identifier is computed in your browser and kept in this cookie for 1 hour, so we can spot one device opening many accounts. If you buy credit while it is set, we send it, with your IP address, to Stripe, our payment processor, so the payment can be checked for card testing. It is set in every country, including when you choose "essential only", and used for nothing else.
• Google and Microsoft sign-in check (__Secure-authjs.pkce.code_verifier) — set for at most 15 minutes while you sign in with Google or Microsoft, so that only your browser can complete that sign-in.
• "Keep me signed in" choice (qr_keep) — set for 10 minutes when you sign in with "Keep me signed in" unticked, so that sign-in ends after 12 hours.
• Friend invite (wp-ref) — when you sign up with Google from a friend's invite link, keeps the friend's invite code for 10 minutes so the invite is credited.
• Language (quikring-locale) — remembers the language you picked, for 1 year. Set only when you change the language.
• Team single sign-on (qr_saml_req, qr_saml_ticket, qr_saml_hint, qr_saml_bounce) — set only while a team member signs in through their company's single sign-on, for 10 minutes at most.
• Human-verification cookie (Cloudflare Turnstile) — set briefly when you sign up, sign in or use our contact, chat or report forms, to confirm you're not a bot. Not used for tracking or advertising.

Your cookie choice itself is kept in your browser's local storage (quikring-cookie-consent), not in a cookie, until you change it or clear your browser's data.

These are set if you choose "Accept all" in the cookie banner, or by default where no banner is shown (see "Your cookie choice" below):

• Product analytics (PostHog) — helps us see which pages are read, where people click and which features are actually used, so we can improve the product. It may also record how a page is used (clicks, scrolling, layout); what you type into form fields and chat messages are hidden from those recordings, and pages inside your account are never recorded. Not shared with advertisers. Sets one cookie, ph_<project key>_posthog, kept for 1 year, and keeps a copy of the same identifier in your browser's local and session storage.
• Google Analytics 4 — tells us which pages and search terms bring people to QuikRing, so we know what's worth writing more of. Sets the _ga and _ga_<ID> cookies, kept for up to 2 years, and sends usage data to Google. We don't send Google your email or any other detail that identifies you personally, and we don't use it for advertising.
• Campaign/referral attribution — remembers which link (an ad, a referral, an affiliate link) first brought you to QuikRing, so we know which channels are actually working: wp-utm-source, wp-utm-medium and wp-utm-campaign (the campaign tags), wp-landing-path (the first page you opened) and wp-referrer-host (the site that sent you), each kept for 30 days. When the link came from an affiliate partner, the wp-aff-code cookie keeps that partner's code for 90 days, so the partner is credited if you sign up later. Not used for advertising or shared with third parties.

If you pay with a card, Stripe's checkout may set essential security and anti-fraud cookies (e.g. to prevent fraudulent transactions and support 3D Secure verification), such as __stripe_mid (kept for 1 year) and __stripe_sid (kept for 30 minutes), which Stripe also sets on our own payment screens inside your account — those are governed by Stripe's own privacy and cookie policy. Google Analytics, listed above, is also a third-party service and its data is handled under Google's own terms — it only ever loads when the optional cookies above are on.

Some of our how-to guides show a video from our YouTube channel. Nothing is loaded from YouTube until you press play. If the optional cookies above are on, the video then plays on our page in YouTube's privacy-enhanced player (youtube-nocookie.com), and once it plays YouTube may store data on your device under Google's own privacy and cookie policy; if they are off, pressing play opens the video on YouTube instead.

We don't embed any advertising trackers.

Where the law requires your consent first — the European Union and European Economic Area, the United Kingdom, Switzerland, Serbia, Turkey, Brazil, Canada, China and South Korea, and whenever we can't tell where you are — we ask on your first visit whether to allow only essential cookies or accept all, and the optional cookies stay off until you accept. Everywhere else, the optional cookies are on by default and you can turn them off at any time with the button below. We work out your country from your connection when the page loads; it is not stored.

Essential cookies are always active either way, since the app can't function without them. Choosing "essential only" means the optional cookies above are never set — Google Analytics is never loaded at all, and how you reached our site is not stored on your device (apart from an affiliate partner's code during a Google or Microsoft sign-in, described above). PostHog still counts your visit anonymously in that case (and, where we ask, before you choose), with no cookies and nothing stored on your device, so we can see how the site is used overall.

Because our essential cookies are strictly functional, blocking them in your browser will likely break the ability to stay logged in or complete signup. You can still clear or block cookies through your browser's settings at any time.

If the cookies we use change, we'll update this page and its "Last updated" date.