Cookie Policy

The short version

SplashSend sets a handful of cookies for signing in and security. Just visiting our website sets none. We use no analytics or advertising cookies.

Cookies we set

• Signing in: once you're signed in, __Secure-ss.session_token keeps you signed in for up to 30 days, and __Secure-ss.session_data keeps a copy of your sign-in for 5 minutes so pages load without looking it up each time. Signing out removes both. Essential.
• Browsers you've used before: once a browser has shown it can read your email, by entering a code we sent you or by signing in with Google, __Secure-ss.trust_device remembers it for 30 days, so your password works there without a code. While we wait for a code, __Secure-ss.two_factor keeps your place for up to 10 minutes. Essential.
• Signing in with Google: __Secure-ss.state lasts 5 minutes and checks that the answer coming back from Google belongs to the sign-in you started. Google's own cookies are set on Google's site, under Google's policy. Essential.
• Connecting Shopify or accepting an invitation: shopify_state (10 minutes) while you connect a store; ss_shopify_claim (up to 7 days), which links an App Store install to the account you then create; and ss_pending_invite (3 hours), which holds an invitation while you sign up. Essential.
• Bot protection: Cloudflare Turnstile checks that a person is filling in our sign-up, contact and waitlist forms. It sets no cookie.
• Visit counts: Cloudflare Web Analytics counts visits to our website and app. It sets no cookie and keeps nothing in your browser.

Our site also keeps a few small things in your browser's storage that are not cookies and are not sent anywhere. The home page remembers where you got to in the tour video. On a shared design, your browser keeps the name you comment under and which comments are yours. When you sign out, our sign-in leaves a short note there so your other SplashSend tabs notice. The note holds nothing about you.

On your own website

If you add SplashSend's tracking script or an embedded form to your website, it keeps some small things in your visitors' browsers, on your site. The tracking script keeps a token so that someone who clicked through from one of your emails can be recognised; on a Shopify store it does so only once the visitor has allowed marketing in the store's cookie banner, and on other sites you can set it to wait for your own banner, in which case it also remembers the visitor's answer. Forms keep a note that a pop-up was closed or filled in, or that the visitor arrived from one of your emails, so a sign-up pop-up does not keep appearing. A form set to a Google typeface fetches it from Google. None of that comes from visiting splashsend.com; it is on your site, under your own cookie notice.

Blocking cookies

Every cookie we set is needed for signing in or for security, so we do not ask for consent. You can still block or delete cookies in your browser's settings; blocking them will stop you signing in.

Contact

hello@splashsend.com