Cookie Policy

What cookies are

Cookies are small text files stored on your device when you visit a website. They help the site work, keep you signed in, protect against abuse, and help us understand how the site is used.

Cookies we use

We use a small number of cookies, grouped by purpose:

• Strictly necessary: required for the site to function, including authentication and session management through Clerk, security and bot protection through Cloudflare Turnstile, and secure checkout through Stripe. These cannot be turned off without breaking core features.
• Analytics: with your permission, Google Analytics helps us understand aggregate product and website usage. Analytics is not required for the service to work. On an initial page load, missing, declined, expired, malformed, or withdrawn analytics consent does not load Google Tag Manager or contact Google. If you withdraw after Google Tag Manager has already loaded in the current document, we may send only the consent-state control needed to apply that withdrawal. We send no later business event or Measurement Protocol request, and Google Tag Manager does not reload on the next navigation while consent remains withdrawn.

We do not use advertising or cross-site tracking cookies.

Attribution and consent records

When you choose whether to allow analytics, we store a local consent record in your browser. An authenticated account may also receive a signed consent receipt so the same decision can be applied safely across index365 product areas. The receipt expires no later than 180 days after your original local decision and does not contain your email address, name, submitted website, payment information, or Google Analytics identifiers.

If you follow an approved index365 content link and allow analytics, we may keep a first-touch attribution record in that browser tab for up to 30 minutes. It uses approved campaign, channel, and content identifiers. It does not store a submitted website, domain, email address, or payment identifier.

With valid consent, a successful account creation may be linked to the approved content source that led to it. If consent is missing, denied, expired, or withdrawn, no protected attribution link is delivered to Google Analytics.

Managing cookies

You can accept, decline, or withdraw analytics consent through the controls we provide. Withdrawing consent stops future protected analytics delivery and removes protected identifiers from pending analytics records. A minimal revocation record may be retained until 180 days after the revocation time so the system can enforce your choice and prevent stale consent from being restored. Strictly necessary authentication, security, abuse-prevention, and checkout technologies continue to operate because the service cannot function safely without them.

Most browsers also let you view, block, or delete cookies through their settings. Blocking strictly necessary cookies may prevent signing in, scanning, or checkout from working.

Changes to this policy

We may update this Cookie Policy from time to time. When we do, we will revise the “Last updated” date above.