Cookie Policy — CloseRev

What we set

Name	Purpose	Lifetime
`__Host-closerev_session`	Keeps you signed in. httpOnly, Secure, SameSite=Lax, and carries the `__Host-` prefix so no other site on a neighboring domain can set it	30 days, or 7 days without use, or until you log out
`g_state`, `g_verifier`	Protects the "Sign in with Google" flow against cross-site request forgery. Only set if you start that flow	10 minutes
`closerev_device`	Remembers this browser, so we can email you if your account is signed in from one we haven't seen. A random value; we store only a hash of it. httpOnly, Secure	400 days
`closerev_mfa`	Carries a two-step sign-in between the password step and the code step. httpOnly, Secure	10 minutes
`sso_state`, `sso_verifier`, `sso_nonce`, `sso_ws`	Protects the single sign-on flow against forgery and replay. Only set if you start that flow	10 minutes
`closerev_conv`	Set for ten minutes when you register or confirm your email, only while Advertising is on: carries the fact that it just happened to the next page, which tells Google's tag once and then deletes it. httpOnly, Secure	10 minutes
`closerev_lang`	Remembers the language you chose	1 year
`closerev_consent`	Records your cookie choices — or, in the United States and Canada outside Quebec, the default we applied — so we don't ask again and the tags you switched off stay off	180 days
`closerev_ad_click`	If you arrived from an ad while Advertising is on, carries that ad's click identifier so a later signup can be attributed to it. Never set while Advertising is off. httpOnly, Secure	30 days
`_gcl_aw`, `_gcl_au`, `_gcl_gs`	Google's, set by its advertising tag only while Advertising is on, and on no signed-in page except the two confirmations described under Categories: the id of the ad you clicked, so a registration in the same session can be credited to it, and an identifier Google uses to tell the people who visited apart from each other	90 days
`li_fat_id`, `ln_or`	LinkedIn's, set by its Insight Tag only while Advertising is on, and never on a signed-in page: the id of the LinkedIn ad you clicked, and a flag LinkedIn uses to decide whether it may measure this site	30 days; 1 day
`_rdt_uuid`, `_rdt_cid`	Reddit's, set by its pixel only while Advertising is on, and never on a signed-in page: an identifier Reddit uses to tell visitors apart, and the id of the Reddit ad you clicked	90 days
`IDE`, `test_cookie` (doubleclick.net); `UserMatchHistory`, `AnalyticsSyncHistory`, `lidc`, `bcookie` (linkedin.com); Reddit's own (reddit.com)	Third-party cookies on Google's, LinkedIn's and Reddit's own domains, set only while Advertising is on, and only if the tags decide to: they let each network recognize a browser it has seen before, which is what showing CloseRev ads to people who visited depends on. We never read them and cannot; see Google's LinkedIn's and Reddit's own cookie pages	Up to 13 months (Google); up to 1 year (LinkedIn); as Reddit sets them (Reddit)

Local storage

We store one preference in your browser's local storage, closerev-theme, so the site remembers whether you chose light or dark mode. It never leaves your device and isn't a cookie.

Where the defaults differ

In the United States and in Canada outside Quebec, Analytics and Advertising start on. The law there allows that with clear notice and an easy way out, so when you arrive we tell you they are on, and one click — on that notice, or at any time from Your privacy choices in the footer — switches either off.

Everywhere else — the European Union, the United Kingdom, Switzerland, Brazil, Quebec, every other country, and anywhere we cannot tell where you are — both are off until you accept. We ask before anything optional runs, and "Necessary only" is as easy as "Accept all".

Global Privacy Control always turns Advertising off, wherever you are. If your browser sends it, advertising stays off even if you click accept, and in the United States and Canada we do not switch anything on by default — we ask you instead. Analytics remains your choice.

What we don't set

No advertising or retargeting cookies while Advertising is off.
No marketing tag on signed-in pages, whatever you chose, with one exception: the confirmation shown right after you confirm your email or pay, where Google's tag reports that one event if Advertising is on.
No session recording or heatmap tools.
No cross-site tracking while Advertising is off, and never of anything you do in your workspace.

Analytics

We measure page traffic two ways. Our own measurement counts pages without setting or reading anything on your device — see Counting pages below. The other is Google Analytics, which does set cookies, so they are written only while Analytics is on — after you accept, or by default in the United States and Canada outside Quebec, as described above. While it is off, Google's tag still runs, with every kind of storage denied: it sets nothing, reads nothing, and sends Google only that a page on this site was viewed, from which country, and that consent was not given — no cookie, no identifier, and any ad click id stripped out. Google calls this consent mode and uses those signals to estimate, in aggregate, what it cannot see. Switching it off costs you nothing: the site behaves identically either way.

Google Analytics cookies (_ga and _ga_<id>) last up to two years and record which pages are visited and roughly where visitors come from. Analytics on its own does not switch on advertising: ad storage, ad-user-data and ad-personalization stay denied unless Advertising is on too. Google Analytics is not loaded on any signed-in page — your workspace, imports and customer records are never sent to it.

To change your mind at any time, use Your privacy choices — linked in the footer of every page — or the same switches in Settings if you have an account. Withdrawing consent is deliberately no harder than giving it. You can also install Google's opt-out add-on, or use your browser's Global Privacy Control signal, which turns Advertising off as described above.

Counting pages

On our public pages we add one to three kinds of daily total. Which page was read, in which language, from which country, and whether the page ran JavaScript — that last one is how we tell a person from a crawler. Where an arrival came from: the website that linked to us, or the ad network whose click brought you, and which page you came in on. And how far people get — a visit, a tour of the demo, a registration, a confirmation, a first import, a payment — along with which step, chapter and headline on the demo itself.

Nothing about you is stored, at any layer. No cookie is set or read, no identifier is created, your address and browser are never recorded, and nothing is kept at a finer grain than a day — so two people are indistinguishable from one person twice. There is no record of a visit; there is a number that went up. That is why it does not wait for the banner: it is a statistic, not a record about a visitor, it is never used for advertising, never joined to anything else and never shared. It runs on our public pages only — never on a signed-in page and never on a page reached by a link we emailed you. Totals are kept for 400 days and then deleted.

To object, tell your browser. If it sends Global Privacy Control or Do Not Track, your browser sends us nothing for these counts: no page beacon and no demo counter, so your visit is never counted as a person who ran the page or toured the demo. Our server still adds one to the total of times the page was served, as it does for every request, crawlers included. You do not have to ask us, and there is nothing to switch off.

Managing cookies

You can clear or block cookies in your browser settings. Blocking the session cookie will stop you being able to stay signed in, since that's the cookie's only job.

Categories

Category	What it does	Who receives data	Your choice
Strictly necessary	Signing in, security, and remembering your light/dark choice	No one — first-party only	Always on; the site cannot work without them
Analytics	Which pages are visited and roughly where visitors arrive from, in aggregate	Google Analytics	Off until you accept; on by default in the United States and Canada outside Quebec, and one click turns it off
Advertising	Remembering that you arrived from an ad, so that if you later send a message, sign up or pay we can tell the ad network it worked; and letting Google Ads, LinkedIn and Reddit recognize your browser so that CloseRev ads can be shown to people who visited. Google's tag runs for this on our public pages and on the pages shown after you register, confirm your email or pay; LinkedIn's Insight Tag and the Reddit Pixel load on our public pages only while it is on. No tag runs on a signed-in page except the confirmation shown right after you confirm your email or pay, where Google's tag reports that one event	Google Ads, LinkedIn, Reddit	Off until you accept; on by default in the United States and Canada outside Quebec, and one click turns it off; always off if your browser sends a Global Privacy Control signal

Advertising is the only category that shares data with other companies. Apart from those two confirmations, nothing in it is loaded on signed-in pages, so your workspace, imports and customer records are never exposed to it.

Google Ads: while Advertising is on, Google's tag keeps the id of the ad you clicked in the _gcl_aw cookie above, reports a contact message, a completed demo tour, a registration, a confirmed email or a payment itself from the page where each happens or the page shown right after it, and may add your browser to an audience so that CloseRev ads can be shown to you on Google's network; our server also tells Google about a message, a registration, a verification or a payment using a scrambled (hashed) version of your email address — no IP address. LinkedIn: while Advertising is on, LinkedIn's Insight Tag loads on our public pages, sets the cookies above, and may add your browser to an audience for CloseRev ads on LinkedIn; our server tells LinkedIn about the same events using the scrambled address and your IP address. Reddit: while Advertising is on, the Reddit Pixel loads on our public pages, sets the cookies above, reports which of those pages you visit (with their titles and descriptions), and may add your browser to an audience for CloseRev ads on Reddit. Its automatic matching, which would read email addresses and phone numbers off the page, is switched off. Our server tells Reddit about a message, a registration, a verification or a payment using a scrambled address, your IP address and Reddit's click id if you came from one of its ads. With Advertising off, no advertising cookie is set, neither LinkedIn's tag nor Reddit's loads, no audience is built, and nothing about you is sent to any of these networks — not the scrambled address, not your IP, and not the fact that anything happened. Google's tag still runs in the cookieless mode described under Analytics, which is the only thing that reaches Google from a visitor with Advertising off.

Changes

We said we would add a consent mechanism before introducing any non-essential cookie, and we did: Google Analytics was added together with the prompt that gates it. That promise still stands for anything we add in future. On 15 September 2026 the Advertising category grew to include LinkedIn's Insight Tag and audiences on both networks, and Google's tag began running in cookieless mode before a choice is made; because that is a different thing to agree to, the prompt asks everyone again rather than reading an earlier acceptance as consent to it. On 22 September 2026 Reddit joined the Advertising category, and the prompt asks everyone again for the same reason. On 2 October 2026 the places where Analytics and Advertising start on narrowed to the United States and Canada outside Quebec; every other country now starts with both off, so everyone was asked again — or, in those two places, told again. Questions: privacy@closerev.com.