Cookie Policy
Last Updated: October 17, 2026
This page lists every cookie and tracking script used on inboxkit.com and app.inboxkit.com, operated by Enrich Labs L.L.C-FZ. It supplements section 2.4 of our Privacy Policy, which explains how the collected data is used and your rights over it.
1. Strictly necessary
Needed for the site and the app to work. They are set without consent because the service cannot run without them.
| Cookie or script | Set on | What it does | Lifetime |
|---|---|---|---|
| Session and sign-in | app.inboxkit.com | Keeps you signed in to the dashboard. | Session, up to 30 days |
| ik_attr | inboxkit.com | Carries the ad click ID and campaign parameters from the marketing site to the app so a signup is credited to the right campaign. Only set when you arrive from an ad. | 90 days |
| ik_attr_first | inboxkit.com | Keeps the ad click ID and campaign parameters of the first ad you arrived from, so a signup is credited to that first campaign as well as the latest one. Only set when you arrive from an ad. | 90 days |
2. Analytics
Tell us which pages are read and where visitors come from. Reports are aggregated; we do not sell this data.
| Cookie or script | Set on | What it does | Lifetime |
|---|---|---|---|
| Google Analytics (_ga, _ga_*) | inboxkit.com and app.inboxkit.com | Visits, pages, traffic source and conversions, shared across the marketing site and the dashboard. | Up to 2 years |
| DataFast (datafast_visitor_id, datafast_session_id) | inboxkit.com | First-party visit and revenue attribution, served from our own domain. | Up to 1 year |
| PostHog (ph_*) | inboxkit.com and app.inboxkit.com | Product analytics and session replay on the marketing site and the dashboard, shared so a visit and a signup count as one visitor. | Up to 1 year |
| Microsoft Clarity (_clck, _clsk) | inboxkit.com | Heatmaps and session recordings of the marketing site. | Up to 1 year |
3. Marketing and attribution
Identify companies and referrers so we can follow up appropriately and pay partners correctly, and let X measure and personalize ads.
| Cookie or script | Set on | What it does | Lifetime |
|---|---|---|---|
| Vector | inboxkit.com | Matches visits to companies for our sales team. | Up to 1 year |
| HappierLeads | inboxkit.com | Identifies visiting companies for outreach. | Up to 1 year |
| Partnero (partnero_*) | inboxkit.com | Records which partner referred you so their commission is paid. | 30 days |
| Google Tag Manager | inboxkit.com | Sets no cookies itself. Loads our advertising tags, currently the X Ads pixel (see the X rows below). | None |
| X Ads (_twclid, _twpid) | inboxkit.com | Set by the X Ads pixel. _twclid keeps the X ad click ID (only set after you click an X ad); _twpid is X's browser ID. Used to measure which X ads lead to visits. | 390 days |
| X Ads (personalization_id) | twitter.com and x.com | Set by X to measure ad performance and personalize ads on X. | Up to 13 months |
| X Ads (muc_ads) | t.co | Set by X to measure ad performance. | Up to 13 months |
| X Ads (guest_id, guest_id_ads, guest_id_marketing) | twitter.com and x.com | X's own cookies, sent along with the X Ads pixel if you have visited or are signed in to X. Used by X for ads and to recognise your browser. | Up to 13 months |
| Cloudflare bot check (__cf_bm) | twitter.com, x.com and t.co | Set because the X Ads pixel loads: X's Cloudflare bot protection uses it to tell people from bots. Not used for advertising. | 30 minutes |
4. Support
Power the in-page support widget.
| Cookie or script | Set on | What it does | Lifetime |
|---|---|---|---|
| Gleap | inboxkit.com | Keeps your support conversation and feedback reports attached to your browser. | Up to 1 year |
5. How to control cookies
Every browser lets you block or delete cookies for a site through its privacy settings. Blocking the strictly necessary cookies will sign you out of the dashboard. For the analytics and marketing vendors, these opt-outs also apply:
- Google Analytics: Browser add-on that blocks Google Analytics on every site.
- Microsoft Clarity: Opt-out instructions in the Clarity terms.
- X Ads (loaded through Google Tag Manager): Turn off ad personalization in your X account privacy settings, or block or delete the X cookies in your browser settings.
- PostHog, DataFast, Vector, HappierLeads, Partnero, Gleap: No vendor-wide opt-out; block or delete the cookie in your browser settings.
Visitors from the European Economic Area, the United Kingdom and Switzerland can ask us to stop non-essential tracking for their account by emailing support@inboxkit.com.
6. Changes to this policy
When we add or remove a tracking tool we update the tables above and the date at the top of this page. Material changes are also announced in the dashboard.