Cookie Policy
Effective Date: July 25, 2026 · Last Updated: August 27, 2026
1. What Are Cookies?
Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences, authenticate your session, and understand how you use the site.
2. How ESXPress Uses Cookies
2.1 Essential Cookies (Always Active)
These cookies are necessary for the Service to function and cannot be disabled in our systems.
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
| esx_token | Session presence marker (tells our servers you logged in so protected pages can load; it contains no token, your credentials live only in browser storage and are sent as an Authorization header, validated server-side) | Session marker set by the login flow, expires when the session does: access tokens last 2 hours, and user sessions expire after a period of inactivity (2 hours by default, configurable per account from 5 minutes to 12 hours). The countdown restarts every time the app is used, so an active session stays signed in; signing out only happens after a full stretch of inactivity. Not set when cookie-based persistence is disabled by configuration | Secure, SameSite=Lax |
| csrf_token | CSRF protection token | 24 hours | Secure, SameSite=Strict |
No consent required for essential cookies under GDPR (strictly necessary exemption) and CCPA.
2.2 Analytics Cookies (Opt-In)
With your consent, we may use analytics cookies to understand usage patterns and improve the Service.
| Provider | Purpose | Data Collected |
|---|---|---|
| Google LLC: Google tag (gtag.js / GA4, G-JR0NTXGRXN) | Page views and signup conversion events for Google Ads conversion tracking | Usage and conversion metrics sent to Google (no account PII, no email, name, or claim data) |
Status: Enabled on the production site since August 27, 2026 (operator decision), the Google tag loads only when the build sets NEXT_PUBLIC_GTAG_ID and sets standard Google-analytics cookies. Consent is requested via the consent banner (see Section 3).
2.2b First-Party Measurement Cookie (Always Active)
When you arrive through one of our marketing short links (an ad, email, QR or NFC card), ESXPress sets a single first-party cookie to record which link brought you, so we can see which ads actually produce signups. It contains only an opaque click identifier (no name, email or address), never leaves our own domain, and does not build an advertising profile.
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
| esxpress_clk | Links a visit/signup back to the marketing short link (ad campaign) that sent you, first-party measurement only, no personal data | 30 days | HttpOnly, Secure, SameSite=Lax |
2.3 Marketing Cookies (Opt-In)
With your consent, we may use marketing cookies for promotional communications.
Status: Marketing cookies are not currently deployed. If enabled in the future, opt-in consent will be required.
3. Cookie Consent Management
3.1 Consent Banner (deployed 2026-09-01)
ESXPress displays a cookie consent banner on first visit. Tracking consent defaults to DENIED: Google consent mode is configured with ad storage, analytics storage, ad user data and ad personalization all denied before the Google tag is used. Accepting enables the Google tag analytics/conversion signal; rejecting (or a browser Do-Not-Track / Global Privacy Control signal) keeps all tracking denied. The choice is stored per-device and can be changed at any time. Essential cookies (see Section 2.1) remain exempt from consent requirements under GDPR and CCPA.
3.2 If Non-Essential Cookies Are Added
We currently deploy one analytics tracker via the Google tag (see Section 2.2); we do not deploy marketing cookies (see Section 2.3). If we add further non-essential trackers in the future, we will extend the consent banner with opt-in choices before any new non-essential cookie is set, and consent preferences will be recorded and manageable through your account settings.
3.3 Managing Cookies Today
The cookie consent banner is deployed (2026-09-01) and tracking defaults to DENIED. You can change or withdraw your choice at any time via the banner or the consent reset control on this page. You can also control cookies through your browser settings (see Section 6), and you can contact us at any time:
- Email: hello@esxpress.org
4. Third-Party Cookies
ESXPress uses these third-party services that may set cookies:
| Service | Purpose | Cookie Domain |
|---|---|---|
| Stripe | Payment processing | js.stripe.com |
| Cloudflare | Security/CDN | cloudflare.com (__cf_bm) |
| Google (Google tag / GA4 G-JR0NTXGRXN) | Analytics and signup conversion events (see Section 2.2) | googletagmanager.com, google-analytics.com |
| Google Ads (auto-tagging) | Ads click identifiers (_gcl_au, _gcl_aw, _gcl_dc), set only while Google Ads conversion tracking is active | google.com, doubleclick.net |
Third-party cookies are subject to the respective providers’ privacy policies.
5. Cookie Duration
| Cookie Type | Max Duration |
|---|---|
| esx_token (session presence marker) | Set by login for the length of the session: a 2-hour access token, and user sessions expire after a period of inactivity, 2 hours by default, configurable per account from 5 minutes to 12 hours. The countdown restarts every time the app is used, so an active session stays signed in; signing out only happens after a full stretch of inactivity. Contains no credentials and is not set when cookie-based persistence is disabled by configuration |
| csrf_token (CSRF protection) | 24 hours |
| esxpress_clk (first-party measurement) | 30 days, set only when the visit came through a marketing short link (esxpress.org/l/<slug>) |
| Session cookies | None currently deployed |
| Google analytics cookies (_ga, _ga_<container-id>, _gid) | Set only when the Google tag is enabled, durations follow Google's documented defaults (Section 2.2) |
| Google Ads click identifier (_gcl_au) | Set only while Ads conversion tracking is active, duration follows Google's documented defaults |
6. Browser Controls
Most browsers allow you to control cookies through settings:
- Chrome: Settings → Privacy & Security → Cookies
- Firefox: Options → Privacy & Security → Cookies
- Safari: Preferences → Privacy → Cookies
- Edge: Settings → Cookies and Site Permissions
Note: Blocking essential cookies may prevent the Service from functioning properly.
7. Do Not Track (DNT)
ESXPress does not currently respond to browser “Do Not Track” signals because no industry standard for DNT response has been adopted. We do not track users across third-party websites.
8. Changes to This Policy
We may update this Cookie Policy from time to time. Material changes will be communicated via email to account holders and/or a notice on our website.
9. Contact
For questions about our cookie practices:
- Email: hello@esxpress.org
- Phone: (918) 9-PDF-ESX · (918) 973-3379
- Website: https://esxpress.org