Cookie Policy
1. What are cookies?
Cookies are small text files that are stored on your device when you visit a website. They make it possible to recognise you or your device on a later visit, to maintain sessions or to provide functions that would not be possible without recognition. Comparable technologies (local storage, session storage, pixels, fingerprinting) are treated as equivalent to cookies for the purposes of this policy.
This policy supplements our Privacy Policy.
2. Legal Bases
The storage of and access to information on your device are governed by § 25 TTDSG. We only use cookies if:
- they are strictly necessary to provide the telemedia service expressly requested by the user (§ 25(2) No. 2 TTDSG), or
- you have previously given valid consent (§ 25(1) TTDSG in conjunction with Art. 6(1)(a) GDPR).
The processing of personal data obtained through cookies is additionally based on Art. 6(1)(b) GDPR (performance of contract), Art. 6(1)(f) GDPR (legitimate interest in security and stability) or Art. 6(1)(a) GDPR (consent).
3. The Codaiq Cookie Banner
On your first visit, Codaiq displays a cookie banner with three clearly separated actions:
- Accept all — all categories (essential, analytics, marketing) are activated.
- Reject non-essential — only essential cookies are set; analytics and marketing remain deactivated.
- Customize — granular toggles per category. Essential is permanently active (technically required); analytics and marketing can be toggled individually.
Your selection is persisted in the browser's localStorage under the key codaiq.cookie-prefs (as well as an additional marker cookie-consent for the banner status). The toggles control the real activation of the respective scripts and processors — no sham choice.
Would you like to change or withdraw your selection?
4. Overview of Cookies Used
The following table lists the cookies set by Codaiq itself (first-party) as well as those set by our processors after consent.
| Name | Purpose | Storage period | Provider | Category |
|---|---|---|---|---|
| __Secure-next-auth.session-token | Authentication of the logged-in session (NextAuth, secure HTTPS variant). | Session / max. 30 days | Codaiq (first-party) | Essential |
| next-auth.csrf-token | Protection against cross-site request forgery (CSRF) during auth actions. | Session | Codaiq (first-party) | Essential |
| cookie-consent | Stores whether you have made the cookie banner selection (Accept / Reject / Customize). | 12 months (localStorage) | Codaiq (first-party) | Essential |
| codaiq.cookie-prefs | Granular cookie preferences per category (essential / analytics / marketing). | 12 months (localStorage) | Codaiq (first-party) | Essential |
| cdq_ref | Affiliate attribution: assigns a sign-up to the referring partner (contract initiation). | 30 days | Codaiq (first-party) | Essential |
| _ph_* | PostHog analytics: pseudonymous session and event IDs for product analytics (e.g. _ph_session_id, _ph_distinct_id). Set only after consent. | up to 12 months | PostHog (EU region) — processor | Analytics |
| codaiq_ab_* | A/B test assignment (where active tests are running). No personal data. | 30 days | Codaiq (first-party) | Analytics |
Note: Codaiq currently does not set any of its own marketing or advertising cookies. The "Marketing" category in the banner remains reserved for future optional integrations (e.g. conversion tracking) and is deactivated by default.
5. Third-Party Cookies
5.1 Stripe (payment processing)
During checkout, Stripe Payments Europe, Ltd. / Stripe, Inc. may set cookies and comparable technologies for fraud prevention and 3D Secure verification. These are technically necessary for carrying out the payment process. Details: stripe.com/de/cookies-policy/legal.
5.2 Google OAuth (optional login)
If you sign in with your Google account, Google sets cookies as part of its OAuth procedure. These are subject to Google's privacy policy: policies.google.com/privacy.
5.3 PostHog (product analytics)
After consent, PostHog (EU region) sets cookies and localStorage entries with the prefix _ph_ for pseudonymous reach and function measurement. PostHog acts as a processor pursuant to Art. 28 GDPR. Details: posthog.com/privacy.
5.4 Marketing cookies
Codaiq itself currently does not set any marketing or advertising cookies. We do not use re-targeting or conversion-tracking pixels from advertising networks on the Platform.
6. Disabling Cookies in the Browser
You can additionally view, restrict or delete cookies in your browser. Please note that disabling necessary cookies means you will no longer be able to log in to your Codaiq account.
- Google Chrome: Settings → Privacy and security → Cookies and other site data.
- Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data.
- Apple Safari: Settings → Privacy → Manage Website Data.
- Microsoft Edge: Settings → Cookies and site permissions.
In addition to the "Do Not Track" header (DNT), we also respect the GPC signal ("Global Privacy Control"), insofar as the provider of this function communicates a corresponding waiver of non-essential data processing.
7. Changes to this Cookie Policy
We update this Cookie Policy when the use of cookies changes. Material changes will — as described in our Privacy Policy Privacy Policy — be announced.
8. Cookie Controller
If you have any questions about the use of cookies, please contact:
- Codaiq LTD (Companies House No. 16537316)
- 71-75 Shelton Street, Covent Garden
- London, United Kingdom, WC2H 9JQ
- E-Mail: info@codaiq.com
- Telefon: +971 58 560 6084