Cookie Policy

This policy explains what Kriva stores in your browser and why. It is short because we store very little.

What we set

Two cookies, both strictly necessary for the site to work:

• csrftoken — set only on pages with a form. It stops a third party submitting that form on your behalf. Without it the form cannot be used.
• sessionid — set only when a member of our staff signs in to the internal admin panel. Ordinary visitors never receive it.

Browsing the marketing pages sets no cookies at all.

What we do not set

• No analytics cookies. We do not run Google Analytics, Meta Pixel, Hotjar, Mixpanel, PostHog or any equivalent.
• No advertising or retargeting cookies.
• No cross-site tracking, and no cookies that profile you.
• No cookies are sold, rented or shared with data brokers.

Because the only cookies we set are strictly necessary for a service you have asked for, we do not show a consent banner. Under the EU ePrivacy Directive and the UK PECR, strictly necessary cookies are exempt from consent. If we ever add anything that is not, a consent banner will appear before it loads, and it will default to off.

Third parties that can see your request

These are not cookies, but they are data transfers and you should know about them:

• Google Fonts — the marketing site loads its typefaces from Google's servers, which means Google receives your IP address when a page loads. We are moving these fonts onto our own servers to remove that transfer.
• Paddle — our payment processor. Their script loads only on the checkout page, and only when you choose to pay. It is required to take a card payment securely; we never see or store your card details.
• Meta (Facebook and Instagram) — only for shop owners who connect their own Page, and only to send and receive that shop's messages.

Local storage in the mobile app

The Kriva app stores your sign-in token in the Android Keystore or iOS Keychain, and a small number of display preferences on the device. None of it is a cookie, none of it is shared, and signing out removes the token.

Controlling cookies

Every browser lets you block or delete cookies. Blocking the csrftoken cookie will stop our forms working, which is a limitation of how form security works rather than a choice we made.

Contact

Questions about this policy: hello@kriva.app.