Cookie policy

1. Scope

The cookies and similar technologies (browser localStorage) written on crossell.io and the app. Controller and rights: see the Privacy Notice.

2. How choices work

Strictly necessary cookies run without consent (needed for the service you ask for). Preferences and Analytics run only with your explicit consent. The banner offers "Accept all", "Reject non-essential" and "Customise" with equal weight; until you choose, only necessary cookies run. Your choice is stored in localStorage under crossell.consent.v1 and is asked again when the scope changes. Change or withdraw it any time via "Cookie settings" in the footer; withdrawing analytics stops Google Analytics and PostHog and deletes their cookies.

3. Cookie list

3.1 Strictly necessary: __Secure-next-auth.session-token (sign-in session, 30 days); __Host-next-auth.csrf-token (CSRF protection, session); __Secure-next-auth.callback-url (return page, session); __Secure-next-auth.state / pkce.code_verifier (Google sign-in check, 15 minutes); crossell.active-business (which business is open, 30 days); crossell_signup_intent (plan chosen before sign-up, 1 hour); checkout_return_to_client (return after checkout, 1 hour); <channel>_oauth_state, oauth_ws_<channel> and related channel-connection cookies (security check while connecting a sales channel, up to 10 minutes); crossell.internal (Crossell staff only: excludes our own visits from analytics, 400 days); crossell.consent.v1 in localStorage (your cookie choice). Stripe's checkout page runs on Stripe's own domain under Stripe's policy. Cloudflare security cookies appear only if traffic is proxied by Cloudflare.

3.2 Preferences (consent): crossell.uiLocale (interface language, 1 year); sidebar_state (side menu open/closed, 7 days); theme in localStorage (light/dark); crossell.rememberEmail / crossell.lastLoginEmail in localStorage (remember your e-mail on the sign-in screen, only if you tick "remember me"); dismissed-banner keys in localStorage.

3.3 Analytics (consent): _ga, _ga_<id> (Google Analytics 4, Google LLC, US; Google default 2 years); ph_<project key>_posthog cookie + localStorage (PostHog, EU; only when enabled; PostHog default 1 year). PostHog traffic is proxied through crossell.io/ph and your IP is not passed on.

3.4 Marketing: no advertising cookie or tracking code is used and this category is not offered; no advertising pixel is loaded.

4. Measurement in e-mails

Our e-mail provider (Resend) reports delivery of the e-mails Crossell sends; only the delivery event is stored against your account. Opens and clicks are not recorded; such events are ignored if they arrive.

5. Browser settings

You can also delete or block cookies in your browser; blocking necessary cookies breaks sign-in and checkout.