Template — have a lawyer review before launch. This text is a starting point, not legal advice.
Legal
Cookie Policy
Last updated October 1, 2026
Short version: XCap uses one essential cookie to keep you signed in. We don't use analytics, advertising or tracking cookies, so there's nothing to opt in to or out of.
1. The cookie we use
| Name | Purpose | Lasts | Type |
|---|---|---|---|
| xcap_session | Keeps you signed in. Contains a random token, not personal data. HttpOnly and SameSite=Lax. | 30 days, or until you sign out | Strictly necessary |
2. Local storage
Your browser's local storage may remember small preferences, such as that you closed the cookie notice. This stays on your device and isn't sent to us.
3. Tracked links
When someone clicks a tracked link made in XCap, we count the click using a daily-salted hash of their IP address and browser. We don't set a cookie on their device.
4. Third parties
Stripe may set its own essential cookies on its checkout and billing pages to prevent fraud. Those pages are run by Stripe under its own policy.
5. Your choices
Because the only cookie is essential, the Service won't work signed-in without it. You can delete it at any time in your browser settings, which signs you out.
6. Contact
Questions? XCap — legal@xcap.app