Hookova1. What a cookie is
A cookie is a small file a website stores in your browser so it can recognise your browser on the next request. Related technologies — local storage, for instance — do the same job for data that never needs to reach our server.
2. Strictly necessary cookies
All of these are set by hookova.com and are required for the service to function. There is no way to use a signed-in account without them.
- authjs.session-token (or __Secure-authjs.session-token over HTTPS) — holds your signed-in session so you don't have to log in on every page. Expires after 30 days, or when you sign out.
- authjs.csrf-token (or __Host-authjs.csrf-token) — protects sign-in and sign-out requests against cross-site request forgery. Session cookie; cleared when you close the browser.
- authjs.callback-url (or __Secure-authjs.callback-url) — remembers where to send you back to after signing in. Session cookie.
3. Analytics cookies
We use Google Analytics 4 to count visits and see which pages people arrive on. It runs two measurement properties, and sets these cookies on hookova.com:
- _ga — a random id for your browser, so that a second visit is not counted as a second person. Expires after two years.
- _ga_<property> — one per analytics property, holding session state so that one visit is not counted several times. Expires after two years.
Google's script sets them on our own domain, so they are first-party cookies rather than the cross-site kind. Google receives your IP address and the address of the page you are on; what comes back to us is aggregate — visit counts, referrers, coarse location — and never identifies you by name.
These are not strictly necessary. Refusing them costs you nothing at all on this site, and section 6 explains how.
4. Local storage
Two preferences live in your browser's local storage rather than in a cookie, and are never sent to us:
- sh-theme — whether you chose light or dark mode.
- hv-notices — your recent in-app notifications, so the bell menu survives a refresh.
Clearing your browser's site data removes both.
5. Third-party cookies
No other company sets a cookie on hookova.com. The analytics cookies in section 3 are the nearest thing: Google's script writes them, but it writes them to our domain, so they are first-party and are not readable by anyone else. Third-party domains only come into it when you leave ours — if you pay for a plan, Stripe's checkout and billing portal are hosted on Stripe's own domains and set their own cookies there, governed by Stripe's cookie policy, and signing in with Google sends you to Google's domain, which does the same.
6. Managing cookies
Every major browser lets you view and delete cookies, and block them by site. Blocking ours will stop you from signing in, but the public pages — the landing page, guides, and blog — will keep working.
To refuse the analytics cookies on their own, while staying signed in, any one of these is enough:
- Install Google's own opt-out add-on, at tools.google.com/dlpage/gaoptout. It applies to every site, not just this one.
- Delete the _ga cookies for hookova.com in your browser's site settings, and block that site from setting cookies you have not asked for.
- Block www.googletagmanager.com. Most content blockers and several browsers already do this by default, in which case you have already opted out and need do nothing.
7. Changes and contact
If the list above changes, this page changes with it. Questions: hookovasupport@gmail.com.