What Are Cookies?
Cookies are small text files stored on your device when you visit a website. This policy also covers similar storage technologies we use (localStorage,sessionStorage, IndexedDB) and scripts that read information from your device; the EU ePrivacy rules (Art. 5(3) of Directive 2002/58/EC, in the Czech Republic §89(3) of Act No. 127/2005 Coll.) treat them the same way. Below we list every one we use, who sets it, why, for how long, and whether it needs your consent.
Summary
- Strictly necessary storage (sign-in, language, security, your cookie choice) is always on.
- Analytics — Google Firebase Analytics, Mixpanel, Microsoft Clarity, Vercel Analytics, Ahrefs Web Analytics, Sentry replay and our own WebmasterID tool — runs only after you accept analytics in the cookie banner, and stops when you withdraw.
- Advertising tags — Google Ads and the Meta Pixel — are used only on our ad landing pages (
/get-started,/quiz,/quiz/fb), never on the rest of the site, and are governed by a separate choice shown on those pages. - Marketing attribution: we record how you first reached us in a first-party cookie (
tp_first_touch). This cookie is currently set on your first visit, before you answer the banner; see below for what it holds and how to remove it.
Strictly Necessary
Required for the Service to work: signing in, language, security and fraud prevention, and remembering your privacy choices. They cannot be switched off without breaking the Service. Legal basis: the exemption for strictly necessary storage in Art. 5(3) ePrivacy Directive / §89(3) of Act 127/2005; the processing itself relies on Art. 6(1)(b) GDPR (providing the Service) and Art. 6(1)(f) GDPR (security).
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| sb-<project>-auth-token (may be split into .0, .1) | TwinPhone (Supabase, EU) | Keeps you signed in. | Up to 400 days; removed when you sign out | Cookie |
| NEXT_LOCALE | TwinPhone | Remembers the language you chose. | Session | Cookie |
| tp-console-lock | TwinPhone | Sends business-console users to the right address right after sign-in. | 5 minutes | Cookie |
| twinphone-cookie-consent | TwinPhone | Stores your cookie choice and the policy version you answered. | Until you change it or clear browser storage | localStorage |
| twinphone-anon-id | TwinPhone | Random ID attached to the receipt of your cookie choice, so we can show what you chose. | Until you clear browser storage | localStorage |
| tp_lp_consent | TwinPhone | Your ad-measurement choice on the ad landing pages (see below). | Until you change it or clear browser storage | localStorage |
| tp_session_v1 | TwinPhone | Per-tab ID for the security and activity log of signed-in accounts. | Until the tab is closed | sessionStorage |
| __stripe_mid, __stripe_sid | Stripe | Fraud prevention during checkout (checkout pages only). | 1 year / 30 minutes | Cookie |
| Cloudflare Turnstile | Cloudflare | Bot check on the sign-up and sign-in forms. Runs in Cloudflare's own frame. | Set by Cloudflare | Provider frame |
| Interface keys (tp_* / twinphone-* other than those listed here), tp_referral_ref | TwinPhone | Remember things you did in the interface — a dismissed notice, quiz progress, a dialler hand-off, a referral code from a link you opened. Never sent to third parties. | Until the tab is closed, or up to 30 days (tp_referral_ref) | localStorage |
Error monitoring by Sentry also runs on every page: when something breaks, an error report (page address, browser, technical error details, without your name or email) is sent to Sentry so we can fix it. It stores nothing on your device.
Marketing Attribution (first-party)
These help us understand which websites, searches and campaigns bring visitors who sign up and pay. They are set by TwinPhone, not by an advertising network. tp_first_touch is currently set on your first visit, before you answer the cookie banner. You can delete it at any time in your browser settings; the Service works the same without it.
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| tp_first_touch | TwinPhone | Records how you first reached us: referring site, campaign tags (utm_*), Google click ID (gclid/gbraid/wbraid) and landing page. If you sign up, it is linked to your account and copied into the metadata of your payments and into server-side revenue measurement (see below). | 400 days | Cookie |
| tp_attribution_v1 | TwinPhone | The same campaign tags for the current tab. | Until the tab is closed | sessionStorage |
| tp_lp_sid | TwinPhone | Session ID for our own statistics of the ad landing pages (which step of the form people reach). Stored in our database; not shared. | Until the tab is closed | sessionStorage |
Analytics (only with your consent)
Help us understand how the site and the product are used so we can improve them. None of these load until you click “Accept all” (or switch Analytics on under “Manage preferences”). If you later withdraw, we stop them on the page you are on, delete the Google Analytics cookies, opt you out of Mixpanel and Clarity, and clear the WebmasterID and Mixpanel storage. Legal basis: your consent (Art. 6(1)(a) GDPR).
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| _ga, _ga_<ID>; firebase-* (IndexedDB) | Google (Firebase Analytics / Google Analytics 4) | Usage statistics. When you are signed in, linked to your TwinPhone account ID (not your email). | Up to 2 years | Cookie |
| mp_<token>_mixpanel | Mixpanel | Product analytics, linked to your account ID, sign-in method and sign-up date. Your email and name are not sent. | Until withdrawal or you clear browser storage | localStorage |
| _clck, _clsk, CLID, MUID | Microsoft Clarity | Heatmaps and session replay of how pages are used. | 1 year / 1 day / 1 year / 1 year | Cookie |
| wmid:av:v1; wmid:as:v1, wmid:as:last:v1; twinphone-wmid-signup-<id> | TwinPhone — WebmasterID, our own analytics tool (data received on servers hosted by Vercel) | Page views (including the page address), clicks, form submissions and a sign-up conversion linked to your account ID. | Visitor ID until you clear browser storage; session keys until the tab is closed | localStorage |
| tp_pv_sent_v1 | TwinPhone | Avoids counting the same page view twice in our own page-view statistics. | Until the tab is closed | sessionStorage |
| sentryReplaySession | Sentry | Privacy-masked replay of a session in which an error occurred (text masked, media blocked). | Until the tab is closed | sessionStorage |
| Vercel Analytics, Vercel Speed Insights | Vercel | Page views and page-speed measurements. | — | None (cookieless) |
| Ahrefs Web Analytics | Ahrefs (Singapore) | Traffic statistics. | — | None (cookieless) |
Most of these providers are in the United States or Singapore; see Section 8 of our Privacy Policy for who receives what, where, and on which transfer terms.
Advertising Measurement — Ad Landing Pages Only
The pages people reach from our paid ads — /get-started, /quiz and /quiz/fb — use Google Ads conversion tracking (with Google Consent Mode) and, on /quiz/fb, the Meta Pixel. They tell Google and Meta whether a visit from their ad led to an enquiry, a sign-up or the start of a checkout. Google and Meta receive your IP address, browser details, the page address (which may contain the ad click ID) and these events, and use them under their own privacy policies; for the data collected through the Meta Pixel, Meta Platforms Ireland and we are joint controllers. The rest of the site does not load these tags.
| Name | Provider | Purpose | Duration | Type |
|---|---|---|---|---|
| _gcl_au (and _gcl_aw after an ad click) | Google Ads | Measures whether a visit from a Google ad led to an enquiry, sign-up or payment. | 90 days | Cookie |
| _fbp | Meta (Meta Pixel, /quiz/fb only) | Measures whether a visit from a Facebook or Instagram ad led to an enquiry or sign-up. | 90 days | Cookie |
- EEA, UK and Switzerland: advertising cookies stay off until you click “Accept all” in the bar on those pages. Until then Google Consent Mode runs in its “denied” state and the Meta Pixel is loaded with consent revoked; in this state the Google and Meta scripts are still downloaded, which lets those companies see your IP address and the page you are on, but no advertising cookies are set and no Meta events are sent. You can change your choice with “Cookie settings” at the bottom of each landing page.
- Everywhere else: ad measurement is on by default. Use “Your privacy choices — Do Not Sell or Share” at the bottom of each landing page to turn it off in one click; your browser then stays opted out on those pages.
- Global Privacy Control / Do Not Track: if your browser sends either signal, ad measurement on these pages is off in every region and no bar is shown.
- Every choice made on these pages is logged as a receipt (time, choice, policy version, a pseudonymous hash of your IP address).
Measurement Without Cookies (server-side)
When a payment is completed, our server reports it to Google Analytics (amount, product, how you first reached us, and your TwinPhone account ID). These reports are flagged so that Google does not use them for ad personalisation, and we do not send them if the most recent cookie choice you made while signed in refused analytics. Nothing is stored on your device for this. Details are in Section 8 of the Privacy Policy.
Managing Your Choice
When you first visit TwinPhone a banner offers “Accept all”, “Accept essential only” or “Manage preferences”; closing it with × counts as essential only. Your choice is stored in your browser and a receipt (time, choice, policy version, a pseudonymous hash of your IP address, your browser type and, if you are signed in, your account ID) is logged on our servers so we can show what you chose (GDPR Art. 7(1)). When this policy changes materially we ask again.
You can change or withdraw your consent at any time with “Cookie Settings” in the site footer. Withdrawal does not affect processing that took place before it.
You can also view and delete cookies and site data in your browser settings. Deleting strictly necessary items signs you out; deleting the others does not affect how the Service works.
Do Not Track & Global Privacy Control
If your browser sends a Do Not Track ("DNT") or Global Privacy Control ("GPC") signal, we do not load the analytics tools listed above and the banner is not shown, and on the ad landing pages Google Ads and the Meta Pixel are kept in their opted-out state. We treat GPC as a request to opt out of the sale or sharing of personal information for cross-context advertising. The signal does not change the first-party attribution items described above; server-side payment reports follow the cookie choice you recorded while signed in.
Changes to This Policy
We update this page whenever we add or remove a cookie or tracker, with a new "Last updated" date and, for material changes, a new policy version that brings the banner back so you can choose again.
Contact
Questions about cookies? Email support@twin-phone.com. The data controller is hrhelperg s.r.o., Husitská 502/36, 130 00 Praha 3, Czech Republic (IČO 14270862).