Dotwick uses as little browser storage as it can. We set no advertising cookies and no analytics cookies. A code’s owner may add their own tags and a location request to a code; Dotwick then asks you first and stores only your answer.
01What we set
| Name | Type | Purpose | Lasts |
|---|---|---|---|
| dotwick.session_token | strictly necessary cookie | keeps you signed in to the app | 30 days, renewed while you use it |
| short-lived sign-in cookies | strictly necessary cookie | carry a two-factor or sign-in step between pages | minutes |
| dotwick.theme | local storage (not a cookie) | remembers light or dark mode on this device | until you clear it |
| dotwick-consent | local storage (not a cookie) | remembers your answer to the cookie banner on this device | until you clear it |
| dw_consent_ followed by 12 letters and digits | strictly necessary cookie, only on a code that asks for consent | remembers your answer to that code’s banner, so it is not asked again; set only if you leave “remember” on | 180 days |
Strictly necessary cookies do not need consent; the app cannot sign you in without them, and a page cannot remember that you said no without one.
The Dotwick conversion pixel is different, because it is not on our website. A code’s owner may install it on their own website; it then keeps one first-party cookie there, named _dw_sid, that holds only the signed identifier of the scan you came from, for the attribution window the owner set (1 to 90 days). By default it is set only after you agree on that website, and it is never set if your browser sends Global Privacy Control. The website’s own cookie notice is where you manage it.
02Codes and Hosted Pages
Scanning a code and opening a Hosted Page sets no cookies. Unique devices are counted with a daily-salted hash on our servers instead, and the IP address is not stored.
The one exception is a code whose owner has turned on a tracking tag, a location request or an area limit. Its owner is then the controller of that choice, and the page that opens in front of the destination (or over a Hosted Page) shows a banner with the controller’s name, the vendors it would load, and one switch for each of analytics, advertising and location. Every switch starts off, “Reject all” is as easy to press as “Accept all”, and no tag loads and no location is asked for before you choose. If you decline, you are taken to the destination all the same.
The cookie in the table above is set on the same address you scanned, is not readable by scripts, holds only your answer, the vendors you were shown and the day you chose, and has no identifier or exact time. It is named after the code owner’s Workspace, so the answer you give one business is not used for another.
If you allow location, your browser asks for its own permission too. We keep the position rounded to about 100 metres, with no more precise detail, for 90 days unless the code’s owner chose another period (7 to 395 days, and never longer than their plan keeps scans). A code owner’s tags set their own cookies on their own responsibility, and only after you allow them.
03Analytics
We do not use analytics cookies today. If we add product analytics, it will only run after you agree in a consent banner, and you will be able to change your mind at any time. This page will list the cookies before they are used.
04Your choices
You can delete cookies and local storage in your browser settings. Deleting the session cookie signs you out.
Questions about these documents
Write to legal@dotwick.com. For a signed DPA or a security review, our Enterprise team can send the standard pack.
Security practices, the sub-processors and where SOC 2 stands: Dotwick Trust