Cookie Policy
Last updated: May 2, 2026
2. The categories we use
- Strictly necessary— required for the site to work (mainly: keeping you signed in and protecting forms from CSRF). You can't disable these and have a working sign-in.
- Functional— remember small preferences and the campaign that brought you here. The site works without them; some niceties don't.
- Analytics — help us understand which pages are useful and where things break. Always anonymous, never tied to your account, off by default, on only if the operator has enabled them.
- Anti-abuse — Google reCAPTCHA cookies on authentication forms to deter automated attacks.
We do notuse advertising cookies and we don't allow third-party advertisers to set cookies on this site.
3. The full list
Here is every cookie and local-storage entry the marketing site can set, along with what it does. Items marked "only if enabled by the operator" appear only on deployments that have configured the relevant integration.
| Name | Category | Storage | Purpose | Retention |
|---|---|---|---|---|
| next-auth.session-token | Strictly necessary | Cookie | Keeps you signed in after a successful login. | Up to 30 days, or until you sign out. |
| next-auth.csrf-token | Strictly necessary | Cookie | Protects authentication forms against CSRF attacks. | Session. |
| next-auth.callback-url | Strictly necessary | Cookie | Remembers where you were trying to go before we asked you to sign in, so we can return you there afterwards. | Session. |
| blinkwell.acquisition | Functional | localStorage | Stores the referrer / UTM parameters from your first visit so we can attribute new sign-ups. Cleared automatically once you create an account. | Up to 90 days, or until sign-up completes. |
| blinkwell.first-visit | Functional | localStorage | Remembers your first-visit timestamp so we can show "new user" content once and not on every page view. | Up to 90 days. |
| _GRECAPTCHA | Anti-abuse | Cookie | Set by Google reCAPTCHA on the sign-in / sign-up / password-reset forms to distinguish humans from bots. Only set if reCAPTCHA is enabled by the operator. | Up to 6 months. |
| _ga, _ga_* | Analytics | Cookie | Set by Google Analytics if the operator has enabled it. Records anonymous usage statistics so we can see which pages are useful. | Up to 2 years. |
| _clck, _clsk | Analytics | Cookie | Set by Microsoft Clarity if the operator has enabled it. Records anonymised page-level interaction (clicks, scrolls). | Up to 1 year. |
4. How to control or delete cookies
You can manage cookies through your browser settings:
- Safari — Settings → Privacy → Manage Website Data.
- Chrome / Arc / Edge — Settings → Privacy and security → Cookies and other site data.
- Firefox— Settings → Privacy & Security → Cookies and Site Data.
You can also opt out of Google Analytics specifically using Google's opt-out browser add-on. Disabling strictly-necessary cookies will break sign-in.
5. The desktop app
Blinkwell on macOS is a native app, not a wrapped browser. It does not store cookies, does not have a tracking SDK, and the built-in Network Auditor blocks any outbound network requests made from inside the Blinkwell process. See the Privacy Policy for the long version.
6. Changes to this policy
When we change cookies the site uses, we'll update the table above and the "Last updated" date. Material changes get an email to account holders at least 14 days in advance.
7. Contact
Email [email protected] for anything cookie-related (including a request to delete everything we have on you).