Effective 14 June 2026
Cookie policy
Cookies are tiny text files stored by your browser (browser storage works the same way but never leaves your device). We keep ours to a minimum — here's everything Fidz stores in your browser, in plain English, and how to control it.
The short version
- We use strictly necessary cookies so the site and your sign-in work, and to credit the link that brought you to Fidz. These can't be turned off.
- Audience statistics (Google Analytics 4) exist on the public website only, are off by default, and load only if you click “Accept” (or switch analytics on under “Choose”).
- We use no advertising cookies and no cross-site tracking. We never sell your data.
- You can change your mind anytime with the “Manage cookies” link at the bottom of every page of the public site — see “How to control cookies” below.
Categories we use
1. Strictly necessary
Required for core functions: keeping you signed in, remembering your cookie choice, basic security, and remembering which link or campaign sent a business to Fidz so it can be credited when it signs up (first-party, never shared). They can't be disabled from the banner (you can still block them in your browser, but parts of Fidz will stop working).
2. Functional
Remember the choices you make yourself with a control: language, light/dark mode, the shop location you work on. They are written when you use that control, contain no personal data and are never used for tracking.
3. Analytics (optional)
If — and only if — you accept analytics, we load Google Analytics 4 (Google) on the public website to understand which pages are useful. It sets the _ga cookies and sends page views (page address, referring site, device and browser type, approximate location) to Google, which may process them in the United States. We run Google Consent Mode v2 with everything denied until you accept, advertising storage and personalisation permanently denied, IP anonymisation on, and Google signals off. Nothing is loaded and no analytics cookie is set until you opt in. Analytics never runs in the dashboard, on the sign-in pages or on customer loyalty-card pages.
Every cookie, listed
Some entries exist only in the signed-in dashboard or on loyalty-card pages: a visitor who only reads this website gets the cookie-choice entry and, if they use the language or light/dark control, the matching one.
| Cookie | Category | Purpose | Lasts |
|---|---|---|---|
| sb-* (Supabase sign-in)Cookie | Strictly necessary | Keeps you signed in to your dashboard securely. Set when you sign in; not set for visitors who only browse. | Up to 400 days; the dashboard also signs you out after 2 hours without activity |
| fidz_cookie_consent_v2Browser storage | Strictly necessary | Remembers your cookie choice so we don't ask again. | 12 months, then we ask again |
| fidz_attrCookie | Strictly necessary | Remembers, on your first visit only, the page, campaign tag or website that sent you to Fidz, so a business that later signs up can be credited. First-party only, never shared. Set when the address carries campaign tags or the visit comes from another website. | 90 days |
| fidz_affCookie | Strictly necessary | Remembers the partner code of a partner link (?via=…) so that partner can be credited if you sign up. Set only when you open such a link. | 90 days |
| fidz_kc_* (one per shop)Cookie | Strictly necessary | Counter kiosk of a shop you are a customer of: recognises your phone, for that shop only, so you can take your stamp with one touch. Set by the server (not readable by scripts) when you sign up or confirm your e-mail address with a code. Never shared, never used for advertising. Without it you simply confirm your e-mail address again. | 12 months |
| fidz_kioskCookie | Strictly necessary | Counter kiosk: links a shop's tablet to that shop, so its screen can show the QR code. Set by the server when the shop owner links the tablet; the owner can remove the tablet at any time. | Until the tablet is removed (up to 13 months) |
| fidz_kd, fidz_pwreset, fidz_magic_nextCookie | Strictly necessary | Sign-in security. fidz_kd remembers that this device signed in to your account before, so wrong passwords typed by someone else elsewhere never lock you out (it holds a coded tag, never your e-mail address). fidz_pwreset proves for a few minutes that you opened a password-reset link. fidz_magic_next remembers for one hour the page you wanted to reach, when you ask for a sign-in link by e-mail. Set by the server, not readable by scripts. | 180 days / 15 minutes / 1 hour |
| NEXT_LOCALECookie | Functional | Remembers the language you chose. Set only when you pick a language. | 2 years |
| FIDZ_SCAN_LANGCookie | Functional | Remembers the language you chose on a loyalty-card page. | 2 years |
| themeBrowser storage | Functional | Remembers your light/dark mode. | Until you clear your browser data |
| fidz_locCookie | Functional | Dashboard: the shop location(s) selected in the side menu. | 12 months |
| fidz_scan_locCookie | Functional | Staff device: the shop location this device stamps for. | 12 months |
| fidz_menuCookie | Functional | Dashboard: whether the side menu is open or collapsed to icons. | 12 months |
| fidz_feature_preview, fidz_scan_asCookie | Functional | Dashboard only: the owner's "preview plan features" mode, and the "who is stamping" identity of the stamp screen. | 30 minutes / up to 12 hours |
| fidz_last_activity, fidz_last_login_method, fidz_setup_*, fidz_gs_widget, fidz_ach_seen, fidz_changelog_seen, fidz_onboarding_tour_seen_*, fidz_kpi_export_*, fidz-studio-mode, fidz.schedulePublish.tz, fidz.share.*, fidz_reloaded_at, fidz_chunk_reloaded_atBrowser storage | Functional | Dashboard and sign-in page only: the inactivity timer, what you have already seen or hidden, display choices. They stay on your device and are never sent to us. | Until you clear your browser data (the last two: the open tab) |
| _ga / _ga_*Cookie | Analytics (optional) | Google Analytics 4 audience statistics of the public website. Not set, and the Google tag is not even loaded, unless you accept analytics. | 13 months |
| fidz_staging_gate, fidz_dev_real_flow, fidz_dev_*, fidz-dev-*, fidz-device-test:*Cookie / browser storage | Test environments only | Used by our test copies of the site. They do not exist on fidz.app. | Test use only |
Analytics cookies appear only after you opt in. The exact set can vary slightly as providers update; the categories and your control over them do not.
How to control cookies
- The banner: choose “Decline” to refuse all optional cookies, “Accept” to allow them, or “Choose” to toggle each category individually.
- Change your mind: click “Manage cookies” at the bottom of any page of the public site. Switching analytics off deletes the Google Analytics cookies straight away and the tag is no longer loaded. We also ask again after 12 months.
- Your browser: every major browser lets you block or delete cookies in settings. Blocking strictly-necessary cookies will break login.
Third parties
Some third parties set their own cookies when their features load: Google and Apple on the sign-in buttons (sign-in, sign-up and loyalty-card pages), Google for Wallet, Stripe on checkout. These are governed by their own policies. See our privacy policy for the full list of subprocessors.
Questions
Email hello@fidz.app with “COOKIES” in the subject. See also our privacy policy and terms of service.
© 2026 Fidz · Home