Effective Date: July 25, 2026 · Last Updated: August 27, 2026
Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences, authenticate your session, and understand how you use the site.
These cookies are necessary for the Service to function and cannot be disabled in our systems.
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
| esx_token | Session presence marker (tells our servers you logged in so protected pages can load; it contains no token — your credentials live only in browser storage and are sent as an Authorization header, validated server-side) | Session marker set by the login flow — expires with the session (access tokens last 2 hours; sessions time out after 30 minutes of inactivity with a 12-hour absolute maximum); currently not set when cookie-based persistence is disabled by configuration | Secure, SameSite=Lax |
| csrf_token | CSRF protection token | 24 hours | Secure, SameSite=Strict |
No consent required for essential cookies under GDPR (strictly necessary exemption) and CCPA.
With your consent, we may use analytics cookies to understand usage patterns and improve the Service.
| Provider | Purpose | Data Collected |
|---|---|---|
| Google LLC — Google tag (gtag.js / GA4, G-JR0NTXGRXN) | Page views and signup conversion events for Google Ads conversion tracking | Usage and conversion metrics sent to Google (no account PII — no email, name, or claim data) |
Status: Enabled on the production site since August 27, 2026 (operator decision) — the Google tag loads only when the build sets NEXT_PUBLIC_GTAG_ID and sets standard Google-analytics cookies. Consent is requested via the consent banner (see Section 3).
When you arrive through one of our marketing short links (an ad, email, QR or NFC card), ESXPress sets a single first-party cookie to record which link brought you — so we can see which ads actually produce signups. It contains only an opaque click identifier (no name, email or address), never leaves our own domain, and does not build an advertising profile.
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
| esxpress_clk | Links a visit/signup back to the marketing short link (ad campaign) that sent you — first-party measurement only, no personal data | 30 days | HttpOnly, Secure, SameSite=Lax |
With your consent, we may use marketing cookies for promotional communications.
Status: Marketing cookies are not currently deployed. If enabled in the future, opt-in consent will be required.
ESXPress displays a cookie consent banner on first visit. Tracking consent defaults to DENIED — Google consent mode is configured with ad storage, analytics storage, ad user data and ad personalization all denied before the Google tag is used. Accepting enables the Google tag analytics/conversion signal; rejecting (or a browser Do-Not-Track / Global Privacy Control signal) keeps all tracking denied. The choice is stored per-device and can be changed at any time. Essential cookies (see Section 2.1) remain exempt from consent requirements under GDPR and CCPA.
We currently deploy one analytics tracker via the Google tag (see Section 2.2); we do not deploy marketing cookies (see Section 2.3). If we add further non-essential trackers in the future, we will extend the consent banner with opt-in choices before any new non-essential cookie is set, and consent preferences will be recorded and manageable through your account settings.
The cookie consent banner is deployed (2026-09-01) and tracking defaults to DENIED. You can change or withdraw your choice at any time via the banner or the consent reset control on this page. You can also control cookies through your browser settings (see Section 6), and you can contact us at any time:
ESXPress uses these third-party services that may set cookies:
| Service | Purpose | Cookie Domain |
|---|---|---|
| Stripe | Payment processing | js.stripe.com |
| Cloudflare | Security/CDN | cloudflare.com (__cf_bm) |
| Google (Google tag / GA4 G-JR0NTXGRXN) | Analytics and signup conversion events (see Section 2.2) | googletagmanager.com, google-analytics.com |
| Google Ads (auto-tagging) | Ads click identifiers (_gcl_au, _gcl_aw, _gcl_dc) — set only while Google Ads conversion tracking is active | google.com, doubleclick.net |
Third-party cookies are subject to the respective providers’ privacy policies.
| Cookie Type | Max Duration |
|---|---|
| esx_token (session presence marker) | Set by login for the length of the session: 2-hour access token, 30-minute idle timeout, 12-hour absolute maximum; contains no credentials and is not set when cookie-based persistence is disabled by configuration |
| csrf_token (CSRF protection) | 24 hours |
| esxpress_clk (first-party measurement) | 30 days — set only when the visit came through a marketing short link (esxpress.org/l/<slug>) |
| Session cookies | None currently deployed |
| Google analytics cookies (_ga, _ga_<container-id>, _gid) | Set only when the Google tag is enabled — durations follow Google's documented defaults (Section 2.2) |
| Google Ads click identifier (_gcl_au) | Set only while Ads conversion tracking is active — duration follows Google's documented defaults |
Most browsers allow you to control cookies through settings:
Note: Blocking essential cookies may prevent the Service from functioning properly.
ESXPress does not currently respond to browser “Do Not Track” signals because no industry standard for DNT response has been adopted. We do not track users across third-party websites.
We may update this Cookie Policy from time to time. Material changes will be communicated via email to account holders and/or a notice on our website.
For questions about our cookie practices: