This translation is provided for convenience. For Users in Brazil, the Portuguese version prevails in case of any discrepancy (Terms of Service, Section 17.6).
TRACKNANA COOKIE POLICY
Version: 1.0
Last updated: October 22, 2026
Contact: [email protected] | Privacy channel: [email protected]
SUMMARY TABLE
For information only. It does not replace reading the sections, which prevail in case of any discrepancy.
| Topic | Summary |
|---|---|
| This document covers two places | Our pages (Section 3) and our Users' pages, where the Pixel is installed (Section 4) |
| On our pages | Four session and security cookies, one bot-verification cookie from Cloudflare and, on the institutional website, a language cookie |
| Optional cookies on our pages | None |
| Audience measurement on our pages | A tool with no cookies and no persistent identifier |
| On Users' pages, Free plan | No data sent and no cookie created; only the access log entry for loading the script (Section 4.1) |
| On Users' pages, paid plans | One 90-day cookie and four local storage items, created by the Pixel |
| Who answers for consent on Users' pages | The User, as Controller |
| Consent banner on our pages | None, because there is no optional cookie to consent to |
| Where your account preferences are kept | On the server, linked to your profile |
| Legal basis | Performance of contract and legitimate interest in security and in honouring the language preference (Section 3.1) |
1 | WHAT COOKIES ARE
Cookies are small text files that a website stores on Your device and that the browser sends back on each visit. They let the website recognize the device, keep the session active and remember preferences.
Besides cookies, this Policy covers local storage (localStorage), an area of the browser that keeps information on the device but, unlike cookies, is not sent automatically to the server with each request.
2 | TWO DIFFERENT PLACES
Tracknana is a tool that marketing professionals install on their own pages. This means there are two distinct contexts, with different rules and different parties responsible:
On Tracknana's pages, that is, the institutional website and the Dashboard. Here You are our User, and Tracknana answers for everything. This is Section 3.
On our Users' pages, that is, sales websites, landing pages and checkouts where the Tracknana Pixel has been installed. Here the visitor is our User's customer, not ours. Tracknana provides the tool; the User decides to install it and answers for the consent of their visitors. This is Section 4.
If You reached this document from the website of a company that uses Tracknana, Section 4 is the one that concerns You, and the party to contact to exercise your rights is that company.
3 | ON TRACKNANA'S PAGES
3.1 | Strictly necessary cookies
These are the session and security cookies, essential for the platform to work. Without them, You cannot log in, keep the session active or connect ad accounts securely.
| Cookie | Purpose | Duration |
|---|---|---|
access_token | Authenticates your requests to the platform | 15 minutes |
refresh_token | Renews access without requiring a new login | 7 days |
csrf_token | Prevents another website from sending commands on your behalf | 15 minutes, renewed on each use |
tn_oauth_* | Confirms that connecting an ad account (Google, Meta or TikTok) is completed in the same browser that started it | 10 minutes, deleted when the connection ends |
cf_clearance | Set by Cloudflare, our protection provider, when the browser passes a check against automated access; prevents the check from repeating on every page | 30 minutes |
Legal basis. For the access_token and the refresh_token, performance of contract (art. 7, V, of the LGPD), as they are necessary to provide the Service subscribed to. For the csrf_token, which is also set before any login, and for the tn_oauth_*, legitimate interest in security (art. 7, IX). For the cf_clearance, also legitimate interest in security: it exists to stop bots and automated attacks.
Technical protections. The access_token, the refresh_token and the tn_oauth_* are marked HttpOnly, which means they cannot be read by scripts running in the browser, a measure that reduces the risk of session theft. The csrf_token, by design, must be readable by the page: the protection mechanism adopted requires the page to read it and send it back to the server. Ours are transmitted only over a secure connection and with a restriction that limits their sending in requests originating from other websites. The cf_clearance is set and read by Cloudflare, not by our servers, and is not used to identify You or for tracking.
Website language cookie. On the institutional website, the NEXT_LOCALE cookie keeps, for up to 12 months, the language in which You browse, so that pages open in that language on your next visits. It does not identify You and is not shared. Legal basis: legitimate interest in honouring the preference You expressed (art. 7, IX). Besides these five, Cloudflare sets the cf_clearance when there is a check against automated access. There are no other cookies on our pages.
No sharing. The values of these cookies are read exclusively by our servers and, in the case of the cf_clearance, by Cloudflare, our processor. They are not shared with third parties, do not feed advertising profiles and are not sold.
In plain language. You know how You log into the platform and move through several screens without typing your password on every click? That is the first two cookies, working as a temporary digital badge. The third is a lock against malicious websites that try to send commands through a tab open in Your browser.
3.2 | Audience measurement, without cookies
Our pages load Cloudflare Web Analytics, a measurement tool from our infrastructure provider that uses no cookies and creates no persistent visitor identifier.
It tells us access volume and page performance, not individual behaviour, profiles or cross-site tracking. There is nothing to turn off because nothing is stored on Your device.
3.3 | Your preferences stay on the server
Your Account preferences (language, theme, currency and notifications) are stored on the server, linked to Your profile. They follow You on any device after login, and clearing the browser's cookies does not erase them.
In the Dashboard, the browser keeps some interface preferences locally, so that it loads in the state You left it (Section 5).
3.4 | What we do not use
None of our pages has:
- Advertising or retargeting cookies
- Social media cookies
- Analytics cookies that identify the visitor
- Third-party cookies for commercial purposes
- Cross-site tracking cookies
- Device fingerprinting (fingerprinting)
That is why we do not show a cookie consent banner: there is no optional collection, so there is no choice to be made. This Policy fulfils the corresponding information duty.
4 | ON OUR USERS' PAGES
This section describes what Tracknana's scripts store in the browser of people who visit our Users' pages.
The User decides to install these scripts, and the duty to inform their visitors and obtain the required consents is theirs. Tracknana acts as Processor, under the Data Processing Agreement.
4.1 | Free plan
On the Free plan, the visitor's browser downloads the script from our servers, or from Cloudflare's cache, when it opens the page. That loading is recorded in the access log, kept for 6 months, like any request. Once loaded, the script makes no network request of any kind: it sends no data to our servers, loads no images and sets no cookies.
On the device, its only operation is to store, in local storage, the parameters of the visit's origin:
| Item | Type | Duration | Function |
|---|---|---|---|
tracknana_utm | local storage | 30 days | Campaign origin parameters |
The script also adds these parameters to the page's payment links, when they are not already present, so that the sale can be attributed to the right campaign. The payment platform receives them with the link.
Pixel kept, paused or above the limit. If the Pixel remains installed after the User returns to the Free plan, pauses it or exceeds the plan limit after a downgrade, the visitor's browser still loads the Pixel script, when it does not have it cached, and queries our configuration on each page. The query is refused and nothing else happens: no event is sent and no cookie or local storage is created. Like any request to our servers, both are recorded in the access log, kept for 6 months.
4.2 | Paid plans: the Tracknana Pixel
On paid plans, the Pixel sends data to our servers and stores, on the domain of the page visited:
| Item | Type | Duration | Function |
|---|---|---|---|
_fbp | cookie created by the Pixel | 90 days | Browser identifier in the format the ad platform recognizes |
_tn_vid | local storage | no expiry of its own | Random visitor identifier |
tracknana_utm | local storage | 30 days | Campaign origin parameters |
tracknana_click | local storage | 30 days | Ad click identifiers |
tracknana_touch | local storage | 30 days | Opaque session token, with no personal data |
About the _fbp: who creates it. This cookie has historically been created by Meta. Since the Tracknana Pixel replaces Meta's tool on the User's pages, we now create it, with the same name and the same duration, because it is the only name the platform recognizes.
The name suggests the cookie belongs to Meta; it is stored by the Tracknana Pixel, on the registrable domain of the page visited, and is therefore visible to its subdomains. It is a first-party cookie as to the domain, but it serves a third party's advertising purpose, and that is how it should be classified.
The Pixel also reads, without creating, the _fbc cookie, when it is already present on the page.
4.3 | Delivery modes chosen by the User
The User chooses, per event, how the conversion is delivered. The choice changes what goes into the page:
| Mode | What goes into the visitor's page |
|---|---|
| Server only (default) | Nothing besides the Pixel. No third-party code is loaded. |
| Managed | The Pixel loads the ad platform's script. From then on, the platform sets its own cookies and collects directly from the browser, outside our systems, under its own policy. |
| Bridge | The event is published to the page's data layer, for the User's own tag manager. |
| Disabled | Nothing, and no collection. For purchases, the sale received by webhook is still recorded in the Dashboard, but nothing about it is sent to the ad platform. |
The managed mode is the only one in which third-party code runs on the page, and it requires the User's express activation.
4.4 | Information added to the checkout link
This is not storage on the device, but it is disclosure to a third party and belongs in this Policy.
On links and buttons that lead to the checkout, including when the page opens the checkout by script, the Pixel may add to the address: the campaign origin parameters, when not already present; ad click identifiers; the random visitor identifier; and an attribution token. When the page opens the checkout by script, the Pixel repeats the same navigation with these fields included, without changing the destination.
The token is a signed, opaque string: it contains no name, email, phone number, campaign parameters or any readable data. It is only a reference to a record of ours, which only we can resolve. The payment platform receives a string with no meaning of its own.
When one of these fields is already filled in by the link itself with a valid value, we do not replace it.
4.5 | The User's responsibility
It is the sole responsibility of the User who installs the Pixel to:
- Disclose, in the cookie and privacy policy of their own pages, the use of the Pixel and the 90-day cookie it creates
- Obtain prior consent from visitors, when required by applicable law. Tracknana does not collect this consent and has no mechanism to verify it: collection relies on the fact that You installed the script
- Inform visitors, when enabling managed mode, that third-party code is loaded on the page
- Keep an accessible channel for visitors to exercise their rights
Tracknana does not control the content of the pages where the Pixel is installed, does not validate the compliance of that installation in advance, and has no relationship with the visitors of those pages.
5 | LOCAL STORAGE ON OUR SURFACES
5.1 | In the Dashboard
The browser keeps locally only interface preferences (visual theme, language of the public pages, active Dashboard, the Google Analytics property chosen in each Dashboard and the visibility and order of table columns), so that the interface loads in the state You left it.
These values do not identify You and can be removed at any time in the browser's settings. The authoritative record of your account preferences remains the one on the server, under Section 3.3.
5.2 | In the mobile app
The app does not use cookies. Authentication uses a token kept in the secure vault of the device's operating system, and interface preferences are kept in the app's local storage.
Local storage is deleted when the app is uninstalled. On iOS, the token may remain in the device's keychain after uninstalling, until it expires; logging out before uninstalling removes it. Notification permissions are managed in the device's own settings.
6 | HOW TO MANAGE
You can set your browser to block or delete cookies:
- Chrome: Settings › Privacy and security › Cookies
- Firefox: Settings › Privacy & Security › Cookies and Site Data
- Safari: Preferences › Privacy
- Edge: Settings › Privacy, search, and services
- Opera: Settings › Privacy & security › Site settings › Cookies
Note. On Tracknana's pages, the session and security cookies are strictly necessary: blocking them prevents login and keeping the session. Blocking the language cookie only makes the website open in the default language. On our side, there is no advertising or tracking cookie to turn off.
For local storage, use your browser's option to clear site data. For the mobile app, local data is deleted when it is uninstalled.
If You are a visitor to the page of one of our customers and wish to prevent the tracking described in Section 4, the browser's tools apply in the same way, and the channel to exercise your rights is the company whose page You visited.
7 | DO NOT TRACK SIGNALS
On Tracknana's pages there is no optional tracking: the cookies are for session, security and language, and audience measurement uses neither cookies nor a persistent identifier. For that reason, Do Not Track signals sent by the browser do not change our collection: on our side, there is nothing to turn off.
On our Users' pages, how the signal is handled depends on the configuration and obligations of the User, who is the Controller of that processing.
8 | UPDATES TO THIS POLICY
This Policy will be updated when we add or remove cookies, when we change the way the scripts work on Users' pages, or when applicable law changes.
Should Tracknana start using any non-essential cookie on its own pages, this Policy will be updated in advance and a consent management mechanism will be put in place, with an option to refuse as accessible as the option to accept, before any collection.
Material changes will be communicated by email to the registered address and by a prominent notice on the platform. Non-substantial changes take effect upon publication, with the date and version in the header updated. Previous versions remain available for consultation.
9 | CONTACT
Company: Tracknana Software Development Ltda.
CNPJ: 66.059.324/0001-03
Headquarters: Mamborê, Paraná, Brazil
General email: [email protected]
Privacy channel: [email protected]
Website: www.tracknana.com
Related documents: Privacy Policy · Terms of Service · Data Processing Agreement (DPA)