This Cookie Policy is sections 4 and 5 of our Privacy Policy; section numbers below refer to the Privacy Policy.
4. The _ucid cookie and conversion tracking (Convert, Phase 2)
Customers on Business and higher plans can measure which link or QR code led to a sale on their own website.
- When you click a tracked link, the redirect may add
?ucid=<click_id>to the destination URL. - If the customer has installed our JavaScript snippet or our Shopify/WooCommerce app on their site, that site sets a first-party cookie named
_ucidon the customer's domain containing the click ID. It expires after 90 days. The cookie does not contain your name, email or IP address, and it is not readable by other websites or by other URLCrop customers. - When you complete a lead form or purchase on that site, the customer's site or payment system sends the click ID together with an order ID and order value (and, if the customer configures it, a hashed email or customer ID) to our Conversions API. We join it to the click so the customer can see revenue per link.
Who is responsible. The customer is the controller of the _ucid cookie and of any consent needed for it; in the EU, UK and other jurisdictions with cookie-consent rules, the customer must obtain consent before the cookie is set, and our snippet supports a consent-gated mode. We act as the customer's processor. To opt out on a specific site, decline analytics cookies in that site's cookie banner or delete the _ucid cookie in your browser.
Retargeting pixels. Customers on Pro and higher plans may configure third-party advertising pixels (Meta, Google Ads, LinkedIn, TikTok, X) to fire on their links or pages. Those pixels are governed by the customer's and the advertising platform's privacy notices. We do not receive the data those pixels collect.
5. Cookies and similar technologies on our own properties
We use cookies and browser storage on urlcrop.com, app.urlcrop.com and status.urlcrop.com. We set no cookies of our own on crop.sh or customer-domain redirects. We use no advertising or cross-site tracking cookies on any of our properties.
| Type | Name (examples) | Set by | Purpose | Duration | Consent |
|---|---|---|---|---|---|
| Essential | uc_session, uc_csrf | URLCrop | Keep you signed in; prevent cross-site request forgery | Session / 30 days ("remember me") | Not required |
| Essential (security) | __cf_bm, cf_clearance, Turnstile tokens | Cloudflare, on urlcrop.com, app.urlcrop.com, api.urlcrop.com and crop.sh only | Distinguish people from bots when a request is challenged; protect sign-up and public forms | Up to 30 minutes / 1 year | Not required |
| Functional | uc_theme, uc_locale, uc_last_ws; uc_consent_v1 (browser storage: your cookie choice on urlcrop.com) | URLCrop | Remember dark/light mode, language, last workspace opened | 1 year | Not required (you can clear them) |
| Analytics | ph_* (PostHog) | PostHog on our behalf | Understand how the site and dashboard are used; feature flags | Up to 1 year | Asked for in the EU, UK and other jurisdictions that require it. Until you accept, PostHog runs in cookieless mode and stores no identifier. |
| Analytics | _ga, _ga_* (Google Analytics) | Google, on urlcrop.com only (not the dashboard, crop.sh or customer domains) | Count visits and see which pages and free tools are used. Google signals and advertising features are off | Up to 2 years | Asked for in the EU/EEA, UK and Switzerland, and refused when your browser sends Global Privacy Control: until you accept, Google Analytics sets no cookie and receives only cookieless signals. |
| Interstitial and custom domains | none | — | Our link warning page sets no cookie of its own. Customer domains do not pass through Cloudflare, so no Cloudflare cookie is set there. | — | — |
Cloudflare's security cookies are set only if Cloudflare challenges a request it considers abusive; ordinary visitors following a crop.sh link do not receive one.
How to manage. Use the cookie banner (shown in the EU/EEA, UK and Switzerland) or Cookie preferences at the bottom of every page on urlcrop.com to accept or refuse analytics cookies at any time, wherever you are. The dashboard (app.urlcrop.com) sets no analytics cookies. Your browser also lets you block or delete cookies; blocking essential cookies will stop the dashboard from working. We honour the Global Privacy Control (GPC) signal by treating it as a refusal of analytics cookies.
QalbIT Infotech Pvt Ltd. Questions about this document: business@urlcrop.com.