Cookies

A cookie is a small file a website stores in your browser. The browser’s local storage serves the same purpose; this page covers both.

Without your consent, the website only places what it needs to work:

• kivlo-consent: remembers your cookie choices, so we do not ask again on every page. It also applies to the app. Lasts 6 months, after which we ask for your choice again.
• NEXT_LOCALE: remembers the language you chose, when it differs from your browser’s. It goes away when you close the browser.

Audience measurement trackers are only placed with your consent (see below). The website uses no advertising cookie, and no social network places a tracker on it.

The waitlist form also sends where your visit came from (see Privacy). The website reads it on the first page of your visit, from its address and the name of the site you came from, and keeps it in memory for the visit: nothing is stored in your browser for it.

The app, at app.kivlo.io, places the cookies needed to keep you signed in. No script on the page can read them, and they only travel over HTTPS:

• __Secure-kivlo.session_token: keeps your session open. Lasts 7 days, extended each day you use Kivlo.
• __Secure-kivlo.dont_remember: notes that you did not ask to stay signed in; the session ends with the browser.
• __Secure-kivlo.two_factor: the time to enter your two-factor code. Lasts 10 minutes.
• __Secure-kivlo.trust_device: if you ask for it, avoids asking for the code again on this device. Lasts 30 days.
• __Secure-kivlo.state and __Secure-kivlo.oauth_state: the time to sign you in with Google or Microsoft.

On the sign-up and sign-in forms, as on the kivlo.io waitlist form, Cloudflare’s Turnstile anti-bot check runs in your browser. It reads technical signals from the browser to tell a person from a bot, and sets no cookie to track you.

At sign-up, your browser also computes a fingerprint of your device, sent with the form to limit the free plan to one account per person. Nothing is stored in your browser for this.

If you accept, we use PostHog, hosted in the European Union, to understand how the website and the app are used. Before your consent, the tool is not even downloaded. The data collected is kept for 12 months, session recordings for 30 days (see Privacy).

• ph_…_posthog (cookie and local storage): a random identifier that links the pages viewed during one visit. On the website, no profile is created; in the app, it is linked to your account’s internal identifier, never to your name or e-mail. Lasts 13 months at most.
• Session recordings, on the website and on the pages of the app where you are signed in: all text and every input are masked there, and images, videos and documents removed.

The cookie banner lets you accept everything, refuse everything or choose. Refusing changes nothing in the service.

To go back on your choice, use the button below, on this page, which the “Cookies” link at the bottom of every page opens: the banner will show again. You can also clear cookies from your browser settings.

For any question about cookies: privacy@kivlo.io. You can also lodge a complaint with the CNIL.