Cookie Policy

Collectly sets cookies for three purposes: keeping you signed in; — only if you arrived by following a Collectly partner’s link — remembering which partner sent you, so they can be credited if you create an account; and, on the public pages of this site, Google Analytics, to count visits and see which pages and free tools get used. Google Analytics never runs inside the signed-in application, and you can decline it. There is no advertising network and no advertising cookie anywhere.

Signing in creates a session cookie. It holds a signed token identifying your account, and nothing else — no browsing history, no behavioural profile.

• Session cookie — set when you sign in, so you are not asked for your password on every page. It expires after 30 days, or immediately when you sign out.
• Sign-in support cookies — short-lived values used to complete the sign-in exchange safely and return you to the page you came from.
• Referral cookie (collectly_ref) — set only when you open a Collectly partner’s share link, the kind that ends in /r/ followed by a code. It holds that partner’s code and the time you opened the link, and nothing else. If you create an account while it is there, your new workspace is recorded as referred by that partner, and the sign-up form shows you whose code it is before you submit. It expires 60 days after you open the link, and is deleted as soon as you create an account. If you have already opened one partner’s link, opening a different partner’s link does not replace it until it expires.

All three are httpOnly, meaning page scripts cannot read them, and are marked secure so browsers only send them over HTTPS. None are shared with anyone, and none follow you to other sites.

• Analytics cookies inside the signed-in application. Google Analytics runs on the public pages only.
• Advertising or retargeting cookies. Collectly does not advertise to you and does not sell or share data with anyone who would.
• Cross-site tracking cookies of any kind.
• Tracking pixels in the follow-up emails Collectly drafts. A follow-up sent through Collectly does not report back when your customer opens it.

The public pages of this site — the home page, pricing, the free tools, the articles, sign-up and sign-in — load Google Analytics 4. It tells us how many people visit, which pages and tools they use, and where they came from. It does not run on any page inside the signed-in application, on the operator area, or on pages whose address is itself a private link (password reset, invitations, partner dashboards, subscription confirmations).

• What is sent to Google — the page address without any query string except campaign tags (utm_*, gclid), the page title, the referring site, your browser, device type and approximate location, which Google derives from your connection without storing your IP address. And these events: a click on a sign-up button, starting and completing sign-up, starting and finishing a free tool (its name only), and a completed subscription (the plan, billing interval, amount and a Stripe reference).
• What is never sent — anything you type into a free tool, your email address or name, anything from a connected mailbox, and any invoice, customer or workspace data. A completed subscription is reported from the settings page as the bare address /settings, with no page view and no page title.
• Cookies — _ga and _ga_<id>, set by Google on this domain to tell one visit from the next. They last 13 months. They are not httpOnly, because Google’s script reads them.
• Turned off — Google signals, advertising features and ad personalisation. Nothing collected here is used for advertising.

Your choice. The first time you visit, a notice asks whether to allow analytics. In the European Economic Area, the UK and Switzerland, analytics cookies stay off until you allow them. Elsewhere they are on unless you decline, or your browser sends a Global Privacy Control signal, which we treat as declining. Your choice is stored in your browser’s local storage, not in a cookie, and you can change it here at any time:

Declining stops analytics cookies being used from then on; to remove ones already stored, clear this site’s cookies in your browser. Google processes this data under its own privacy policy, and keeps it for the retention period set in our Analytics account, at most 14 months.

Paying for a subscription hands you to Stripe’s own hosted checkout, on Stripe’s domain. Stripe sets its own cookies there, under its own policy, to process the payment and prevent fraud. Collectly never sees your card details, and those cookies are not ours to set or clear.

Signing out removes your session cookie. You can also clear cookies for this site in your browser settings at any time — the consequence is that you will be signed out and asked to sign in again, and that a partner whose link you followed will not be credited if you then create an account.

Blocking cookies entirely will stop you being able to sign in, because there is then no way to remember that you did.

What happens to your invoices and email once you are signed in is covered in the privacy policy, and how that data is protected in the security overview. Questions about any of it go to our contact page.