Hookova
Open Hookova
Legal

Cookie Policy

Last updated 3 November 2026

Hookova sets two kinds of cookie: the ones that sign you in and keep you signed in, which the service cannot work without, and analytics and ad-measurement cookies, which it can. The ad-measurement cookies are Meta's, and let us see whether our Facebook and Instagram ads lead to signups. Section 6 explains how to refuse everything but the sign-in ones.

PrivacyTermsCookies

1. What a cookie is

A cookie is a small file a website stores in your browser so it can recognise your browser on the next request. Related technologies — local storage, for instance — do the same job for data that never needs to reach our server.

2. Strictly necessary cookies

All of these are set by hookova.com and are required for the service to function. There is no way to use a signed-in account without them.

  • authjs.session-token (or __Secure-authjs.session-token over HTTPS) — holds your signed-in session so you don't have to log in on every page. Expires after 30 days, or when you sign out.
  • authjs.csrf-token (or __Host-authjs.csrf-token) — protects sign-in and sign-out requests against cross-site request forgery. Session cookie; cleared when you close the browser.
  • authjs.callback-url (or __Secure-authjs.callback-url) — remembers where to send you back to after signing in. Session cookie.

3. Analytics and advertising cookies

We use Google Analytics 4 to count visits and see which pages people arrive on. It runs two measurement properties, and sets these cookies on hookova.com:

  • _ga — a random id for your browser, so that a second visit is not counted as a second person. Expires after two years.
  • _ga_<property> — one per analytics property, holding session state so that one visit is not counted several times. Expires after two years.

Google's script sets them on our own domain, so they are first-party cookies rather than the cross-site kind. Google receives your IP address and the address of the page you are on; what comes back to us is aggregate — visit counts, referrers, coarse location — and never identifies you by name.

We also use Meta's pixel to measure our Facebook and Instagram ads. Its script loads from connect.facebook.net and sets these cookies on hookova.com:

  • _fbp — a random id for your browser, so Meta can tie a visit to an ad it showed. Expires after 90 days.
  • _fbc — set only when you arrive by clicking one of our ads; holds that click's id. Expires after 90 days.
  • hv_signup — set by us for at most ten minutes after you create an account, so the signup is reported once. It holds a random id and nothing about you.

Meta receives your IP address, browser user agent and the address of the page you are on. Neither the pixel nor these cookies load at all if your browser sends a Global Privacy Control signal.

On our ad landing pages and the sign-in page, Microsoft Clarity records how the page is used (section 2 of the Privacy Policy). Its script loads from clarity.ms and sets these cookies on hookova.com:

  • _clck — a random id for your browser, so two visits are seen as the same visitor. Expires after one year.
  • _clsk — ties together the pages of one visit into a single recording. Expires after one day.

Microsoft receives your IP address, browser user agent and what the recording captures, with typed text masked. Clarity does not load if your browser sends a Global Privacy Control signal.

None of these are strictly necessary. Refusing them costs you nothing at all on this site, and section 6 explains how.

4. Local storage

Two preferences live in your browser's local storage rather than in a cookie, and are never sent to us:

  • sh-theme — whether you chose light or dark mode.
  • hv-notices — your recent in-app notifications, so the bell menu survives a refresh.

Clearing your browser's site data removes both.

5. Third-party cookies

No other company sets a cookie on hookova.com. The analytics and advertising cookies in section 3 are the nearest thing: Google's, Meta's and Microsoft's scripts write them, but they write them to our domain, so they are first-party. Meta's and Microsoft's scripts do send what they collect to their own servers, as section 3 describes. Third-party domains only come into it when you leave ours — if you pay for a plan, Stripe's checkout and billing portal are hosted on Stripe's own domains and set their own cookies there, governed by Stripe's cookie policy, and signing in with Google sends you to Google's domain, which does the same.

6. Managing cookies

Every major browser lets you view and delete cookies, and block them by site. Blocking ours will stop you from signing in, but the public pages — the landing page, guides, and blog — will keep working.

To refuse the analytics cookies on their own, while staying signed in, any one of these is enough:

  • Install Google's own opt-out add-on, at tools.google.com/dlpage/gaoptout. It applies to every site, not just this one.
  • Delete the _ga cookies for hookova.com in your browser's site settings, and block that site from setting cookies you have not asked for.
  • Block www.googletagmanager.com. Most content blockers and several browsers already do this by default, in which case you have already opted out and need do nothing.

To refuse Meta's advertising cookies, any one of these is enough:

  • Turn on Global Privacy Control in your browser (built into Brave, DuckDuckGo and Firefox's settings; an extension elsewhere). With it on, the pixel never loads and our server sends Meta nothing about you.
  • Block connect.facebook.net. Most content blockers already do.
  • Delete the _fbp and _fbc cookies for hookova.com, and block that site from setting cookies you have not asked for.

To refuse Clarity's session recording, either of these is enough:

  • Turn on Global Privacy Control in your browser. With it on, Clarity never loads.
  • Block clarity.ms. Most content blockers already do.

7. Changes and contact

If the list above changes, this page changes with it. Questions: hookovasupport@gmail.com.

Hookova · hookovasupport@gmail.com