Cookies Policy
Effective date: 25 March 2026 · Last updated: 9 October 2026
What Are Cookies
Cookies are small text files stored on your device when you visit a website. They help the site function correctly, remember your preferences, and understand how you use the service.
Cookies We Use
Essential cookies. Required for the Service to function. These maintain your authentication session, remember your active Workspace, and handle security tokens. You cannot disable these without breaking core functionality.
| Cookie | Purpose | Duration |
|---|---|---|
| mask_session | Keeps you signed in | 30 days |
| mask_workspace | Remembers your active workspace | 1 year |
| oauth_state, oauth_code_verifier, oauth_founding_token, mask_plan_intent | Protect signing in through an outside account provider against forgery, and remember the plan you chose while you sign up | 10 minutes |
| mask_tool_continue | Remembers which free tool, template or public page you were about to use while you sign in through an outside account provider, so you return to it afterwards. It holds only that tool's or template's name or that page's address, with a signed time stamp, never what you entered | 10 minutes |
| webauthn_challenge, webauthn_auth_challenge | Protect passkey sign-in and registration against forgery | 5 minutes |
| mask_2fa_challenge | Holds your sign-in open while you enter your two-step verification code, when your account uses two-step verification and you signed in through an outside account provider. It is sent only to the address that checks the code, and is deleted when you finish | 5 minutes, deleted when you finish signing in |
| stripe_connect_state, stripe_connect_workspace | Protect connecting your Stripe account against forgery | 10 minutes, deleted when the connection completes |
| mask_report_unlock, mask_report_unlock_api | Set on a visitor's device after they enter the correct password for a password-protected shared report, so they are not asked again on that report. It holds a signed confirmation, never the password, and is sent only to that one report | 1 hour |
Preference and referral cookies. First-party cookies that remember a choice you made or how you arrived. They are not used for advertising and are not shared with third parties.
| Cookie | Purpose | Duration |
|---|---|---|
| mask_nav_collapsed | Remembers whether you collapsed the dashboard sidebar | 1 year |
| mask_sc_ack_<page> | Set on a visitor's device when they choose to view a bio page its owner marked as sensitive, so they are not asked again on that page | 12 hours |
| mask_ref | Set when you arrive through an affiliate's referral link, so the referral can be credited if you sign up | 30 days |
Analytics cookies. First-party cookies that help us understand how registered users interact with the platform. These do not track you across third-party websites.
Security (reCAPTCHA) cookies. When bot protection is enabled, our public forms load Google reCAPTCHA, which sets its own cookie and may store data in your browser to tell humans from automated abuse. See the section below for details.
Advertising and marketing cookies. We do not currently use advertising cookies or behavioral tracking cookies, and we do not currently participate in ad networks. Apart from Google reCAPTCHA (used for security on our forms), we do not currently load third-party cookies for marketing or cross-site tracking.
Operator-configured analytics and marketing scripts. The platform supports site-wide analytics and marketing tags that a MASK administrator can turn on, including Google Analytics, Google Ads, the Meta Pixel, an X (Twitter) pixel, and custom scripts. If any are enabled, they can set their own cookies, may involve cross-site tracking, and send data to the provider concerned under that provider's own terms. Where any such tag is in use, it is disclosed in this policy and on our Subprocessors page.
Google reCAPTCHA
To protect our public forms from spam and automated abuse, MASK uses Google reCAPTCHA on pages such as sign-up, login, magic-link, contact, enterprise contact, and founding-creators forms. This feature is enabled at our discretion and may not be active on every form at all times.
When reCAPTCHA is active, it loads a script from Google, sets a third-party cookie (for example _GRECAPTCHA), and sends your IP address and interaction signals to Google to generate an abuse score. This processing is carried out by Google and is subject to Google's Privacy Policy and Terms of Service. reCAPTCHA is listed on our Subprocessors page.
Link and Page Analytics
When visitors click your short links, visit your Bio Pages, or scan your QR codes, we collect analytics data (device type, browser, approximate location, referral source). This collection does not use cookies on the visitor's device. It is based on request metadata at the time of the interaction.
Local Storage
In addition to cookies, we use browser local storage for client-side preferences such as dismissed notifications, onboarding progress, and UI state, for example the preview size you chose in the page editor and the items you opened recently from the command menu. A draft you are working on in one browser tab, such as a bulk link import or what you entered in a free tool before signing up, is kept in that tab's session storage and is cleared when the tab is closed. Local and session storage stay on your device and are not sent to our servers unless you choose to save that work.
Managing Cookies
You can manage cookies through your browser settings. Most browsers allow you to block or delete cookies. Note that disabling essential cookies will prevent you from using the Service.
For detailed instructions on managing cookies in your browser, consult your browser's help documentation.
Changes
We may update this Cookies Policy as the platform evolves. Material changes will be reflected with an updated effective date. For questions, contact privacy@mask.pk.