Cookie policy
Last updated November 8, 2026. Draft for legal review: not legal advice.
This policy lists every cookie Inboxed sets, what it is for and how long it lasts. The public website sets no cookies, and Inboxed uses no advertising, cross-site or third-party cookies anywhere. You can see and remove the optional ones at /legal/cookie-settings.
The public website
Pages like the home page, pricing, the blog and the free tools set no cookies. We count page views with our own cookieless analytics: the browser sends the page address, the referring site and any campaign tags; the server stores a visitor code made from a hash of a salt that changes every day, your network address and your browser type, so a visit can’t be linked to another day, and the network address itself is never stored. If your browser sends Do Not Track or Global Privacy Control, nothing is counted. When we turn on Plausible Analytics it is also cookieless.
Essential: staying signed in
ib_session keeps you signed in to the app. It holds a random token (we store only a hash of it), lasts 30 days, and can’t be read by scripts on the page. Signing out deletes it. Without it the app can’t work, so it isn’t optional.
Essential: secure sign-in and connections
While you sign in with Google or single sign-on, or connect a mailbox, Google Postmaster Tools or Salesforce, a short-lived cookie (ib_gsi, ib_sso, ib_oauth, ib_pm or ib_sf) holds a one-time security code that protects the sign-in from forgery. Each one is limited to the sign-in address it belongs to, lasts at most 10 minutes and is deleted as soon as the sign-in finishes.
Templates picked before sign-up
When you choose “Use this template” and then sign up, ib_tpl remembers which template you picked (its id and nothing else) for up to a day, so setup can end on that template. It’s removed once you create the draft, and it can’t be read by scripts on the page.
Referral links
ib_ref is set only when you open someone’s referral link (/r/ followed by a code). It holds that code and nothing else, lasts 60 days, and is used once: if you create an account, the referral is recorded so the person who invited you can earn credit under the referral program. You can remove it at /legal/cookie-settings; the referral is then not recorded.
Documents shared with you
When you open a document link that an Inboxed customer sent you (an address starting with /d/), ib_dv stores a random code for up to a year, limited to those document links. It lets the sender see views per visitor instead of per page load. The customer who sent the link is responsible for that information; you can remove the cookie at /legal/cookie-settings or in your browser.
Emails sent with Inboxed
Open and click tracking in campaign emails doesn’t use cookies. When a sender turns it on, opens are counted when your email client loads a small image and clicks pass through a redirect on the sender’s tracking domain. Tracking is off by default.
Customers’ own websites
Customers can add the Inboxed website visitor snippet to their own site. It sets no cookies and stores nothing in the browser, does nothing when Do Not Track or Global Privacy Control is on, and can be set to wait until the site’s own consent banner says yes.
Browser storage in the app
The app keeps two small flags in your browser’s storage: one so the sign-up confirmation step doesn’t repeat (cleared when you close the tab) and one when you hide the setup checklist. Neither identifies you or leaves your device.
Why there’s no cookie banner
Consent banners are for cookies that aren’t needed for a service you asked for. Our website sets none, and the cookies above are either needed for something you started (signing in, connecting an account) or set only after you open a referral or document link, with a page to remove them. If we ever add a cookie that needs your consent, we’ll ask before setting it and update this page.
Questions
Write to privacy@inboxed.si. More about how we handle personal data is in the privacy policy at /legal/privacy.