creavio COOKIE POLICY
Last Updated: October 24, 2026
This Cookie Policy explains how creavio ("Platform," "we," "us," "our") uses cookies and similar tracking technologies when you visit creav.io and its subdomains ("Platform").
1. WHAT ARE COOKIES
Cookies are small text files stored on your device by your browser when you visit a website. They help websites remember information about your visit to make your experience better or to provide certain features.
2. COOKIES WE USE
2.1. Essential Cookies. These cookies are necessary for the Platform to function. creavio sets each one only when you use the feature that needs it, and the cookie banner and the opt-outs in Section 2.4 do not turn them off. "HttpOnly" means scripts on the page cannot read the cookie.
(a) creavio_rt. Keeps you signed in to creavio. It holds a refresh token, is HttpOnly, and is set on api.creav.io when you sign in. It lasts 30 days and is deleted when you sign out. In a normal session your creavio access token is kept only in the page's memory, not in a cookie or in localStorage. When you switch into an agency or open a client workspace, the access token for that workspace is kept in the browser tab's session storage, and it is cleared when the tab closes. An invited collaborator's tokens are kept in local storage, as Section 2.2 describes.
(b) __Host-oauth_state_google and __Host-oauth_state_facebook. Set when you sign in with, or connect, a Google or Facebook account, to check that the answer coming back belongs to the sign-in you started. HttpOnly, 2 minutes.
(c) __Host-sso_state. The same check for single sign-on through your organization's identity provider. HttpOnly, 10 minutes.
(d) __Host-oauth_exchange_nonce. Ties the last step of a Google, Facebook or single sign-on sign-in to the browser that started it. HttpOnly, 2 minutes.
(e) creavio_mcp_return. When you sign in to connect creavio to an AI assistant, remembers the connection page to send you back to. It does not hold your sign-in token. 10 minutes.
(f) __Host-creavio-mcp. Set on mcp.creav.io after you sign in there, to keep you signed in while you approve that connection. HttpOnly, up to 1 hour.
(g) portal_session. Keeps a client signed in to a Creator's client portal after the client opens a portal sign-in link. HttpOnly, 24 hours.
(h) creavio_member_<site>. Keeps a member signed in to the members area of a Creator's site after the member uses a sign-in link. HttpOnly, 30 days, deleted when the member signs out.
(i) creavio_c_<link>_reviewer. Remembers you as a reviewer on a shared collection link after you enter your name, so your comments and choices stay yours. HttpOnly, 30 days.
(j) Password cookies. pw_<site>_<page> (8 hours) after you enter the password for a password-protected page on a Creator's site, shpw_<link> (2 hours) for a password-protected preview link, and qrpw_ok (12 hours) for a password-protected QR code link. Each holds the password you entered, or a code that proves you entered it, and is HttpOnly. It is sent only with the page it unlocks and the pages under that page's address, so a password for a Creator's home page is sent with every page of that site.
(k) creavio_originality_withdraw. Set on creavio's own pages, not on a Creator's site, when you opt out: when you click "Reject non-essential" on the cookie banner, when you choose "Opt out of non-essential cookies" at creav.io/privacy-choices, or when you visit with the Global Privacy Control signal turned on. It holds the time of your choice so that app.creav.io can stop originality checks for your creavio write seat the next time you sign in. It is set for creav.io and its subdomains and lasts 12 months. It is deleted once the choice has been applied to your account, once app.creav.io finds that your account has no creavio write seat, or once it finds that you allowed originality checks again after that choice.
(l) Facebook sign-in cookie. Meta's Facebook JavaScript SDK loads on app.creav.io only on the Connect card in the social settings of an agency client workspace, where an agency connects that client's Facebook or Instagram accounts. creavio loads it with its cookie option turned on when that card is shown, before you click, so Meta's SDK may set a Facebook session cookie on app.creav.io. creavio uses it only to connect those accounts, which the agency then manages, including to run their ads. creavio does not use it to track visitors or for creavio's own advertising, and it is never on creavio's public website or on Creator sites. Meta sets the cookie, not creavio, and Meta's cookie policy applies.
(m) Cookie choice. creavio_cookie_consent stores the choice you make on creavio's cookie banner or at creav.io/privacy-choices, for 12 months. On a Creator's site, site_cookie_consent stores the choice a visitor makes on that site's cookie banner, for 12 months.
2.2. Browser Storage. creavio does not set functional cookies. Some features keep information in your browser's local storage or session storage instead, such as copies of recent dashboard data so pages load faster, a device trust token after you choose to remember a device when you sign in with two-factor authentication, notices you dismissed, editor preferences, the name and email address you entered as a reviewer on a shared collection link, an unlock code for a password-protected gallery, and, if you join a Creator's project as an invited collaborator, your collaborator access and refresh tokens, which stay in local storage on that browser until they are removed. Session storage is cleared when you close the tab. You can clear both in your browser settings. A cookie banner on a Creator's site built with the creavio site editor keeps the visitor's choice in local storage.
2.3. Analytics Cookies. We use analytics tools to understand how the Platform is used and to improve features.
(a) Google Analytics 4 (GA4). We use GA4 on creav.io and app.creav.io, only after you accept cookies and not while your browser sends the Global Privacy Control signal. GA4 sets the cookies _ga and _ga_<ID>, where <ID> is our GA4 measurement ID. Google lists a default expiration of 2 years for each. They collect pseudonymous usage data including page views, session duration, navigation paths, and feature interactions. Your IP address reaches Google LLC servers when the data is sent. Google states that GA4 does not log or store IP addresses. We use GA4 data for product analytics and may use it to inform advertising campaigns on platforms where creavio runs ads. Under the CCPA, as amended by the CPRA, sending identifiers to GA4 for that purpose may be "sharing", so California residents may opt out as described in Section 2.4 below.
(b) creavio usage records. These are not cookies and are not anonymous. When you use creavio's agency features, signed in, in an agency workspace, an account with agency features turned on, an agency staff session or a client workspace an agency has opened, the dashboard records some actions you take as usage events, stored with the agency workspace's ID and the email address of the person acting, both taken from the sign-in token, plus the event name, the page path without its query string, the client workspace it concerns if any, a few details about the action, a random ID for the browser tab kept in session storage, and the time. Other accounts, and signed-out visits, record nothing. The cookie banner, the opt-outs in Section 2.4 and the Global Privacy Control signal do not turn them off. They are not sent to Google or used for advertising. Section 8.2 of the Privacy Policy describes them.
(c) Creator site visit counts. When someone opens a page of a Creator's site, creavio adds one to that page's visit count for the day, without a cookie or any identifier. A Creator's home page also reports page speed measurements with the page path and device type.
(d) Creator site visitor events. creavio accepts visitor events from a Creator's site, such as which pages or items a visitor viewed, when the site sends them with a visitor ID of its choosing. Pages built with creavio's site editor do not send them today, and creavio ignores them when the Creator's adaptive intelligence setting is off. creavio stores these events for that Creator, with the label, value and other details the site sends with each event, and, for each visitor ID, keeps a profile with the visitor's device type, referring site and visit count. creavio deletes the events after 90 days and the profile 180 days after the visitor was last seen. If the Creator connects a Meta or Pinterest advertising account, creavio may send the events to that platform as conversion events, using the visitor ID as a pseudonymous identifier. When an event includes them, a conversion event may also carry the visitor's email address, phone number, first and last name, and, for Meta, city, state, ZIP code and country, each hashed before it is sent; the visitor ID, hashed for Meta and not hashed for Pinterest; the visitor's IP address and browser user agent; Meta's fbp and fbc identifiers or Pinterest's click identifier; purchase details such as value, currency, order ID, item IDs and number of items, and search text; and, for Meta, the page address. The Creator decides whether to use this and is responsible for the notice and consent it needs, as Section 5 describes.
2.4. CCPA / GPC Opt-Out for Analytics. California residents and users of browsers that send the Global Privacy Control (GPC) signal may opt out of analytics tracking:
(a) GPC Signal: If your browser sends navigator.globalPrivacyControl = true, GA4 does not run while your browser sends the signal. No action required.
(b) Manual Opt-Out: Click "Your Privacy Choices" in the site footer, which opens creav.io/privacy-choices, and choose "Opt out of non-essential cookies", or click "Reject non-essential" on the cookie banner. This saves your choice for 12 months and turns off GA4 in that browser on the site where you made it.
(c) Browser-Level: You can install the Google Analytics Opt-out Browser Add-on (tools.google.com/dlpage/gaoptout) to block GA4 globally across all sites.
Essential cookies (authentication, security) are not affected by any of the above opt-out methods.
3. WHAT WE USE AND DON'T USE
3.1. Analytics and Advertising Cookies. We use Google Analytics 4 (GA4) for product analytics and may use GA4 data to inform advertising. GA4 sets the _ga and _ga_<ID> cookies described in Section 2.3. You may opt out via the consent banner or at creav.io/privacy-choices.
3.2. Advertising Use of Analytics Data. GA4 data may be used to inform creavio's advertising. California law may treat that as "sharing" for cross-context behavioral advertising, and you can opt out as described in Section 2.4. Clicking "Accept all" on the cookie banner is consent to analytics only. Where the law requires consent before analytics data is used to inform advertising, creavio asks for that consent separately first. If we add an advertising tag to creavio's own pages, we will list it in this policy, and it will run only after a separate consent where the law requires one, not on "Accept all" alone.
3.3. No Social Media Tracking Pixels on creavio's Own Pages. creavio's own pages do not include Facebook Pixel, TikTok Pixel, or similar ad-platform tracking pixels. Meta's Facebook JavaScript SDK is not a tracking pixel and is not used to track visitors or for creavio's own advertising. It loads on app.creav.io only on the Connect card in the social settings of an agency client workspace, to connect Facebook or Instagram accounts that the agency manages, including to run their ads, and is never on creavio's public website or on Creator sites, as Section 2.1(l) describes. A Creator may add them to the Creator's own site or to a short link the Creator creates, as Section 5 describes.
4. THIRD-PARTY COOKIES
The following third parties may set cookies when you use the Platform:
(a) Cloudflare — provides DDoS protection and a Web Application Firewall. May set a short-lived challenge cookie (__cf_bm, __cflb) when assessing browser legitimacy. See Cloudflare's Cookie Policy at cloudflare.com/privacypolicy.
(b) Stripe — when you access billing or checkout flows, Stripe may set cookies to prevent fraud and ensure payment session integrity. See Stripe's Cookie Policy at stripe.com/privacy.
(c) Google — if you choose to sign in with Google or connect a Google Search Console / Analytics property, Google OAuth places an authentication cookie. See Google's Privacy Policy at policies.google.com/privacy.
(d) Meta. When the Connect card in the social settings of an agency client workspace is shown, Meta's Facebook JavaScript SDK loads and may set a Facebook session cookie, as Section 2.1(l) describes. See Meta's cookie policy at facebook.com/policies/cookies.
5. TENANT CANVAS SITES
Each Creator's public Canvas website (creav.io/<username>, or the Creator's own domain) is an independent web property. A Creator may add their own analytics or advertising tags to it, such as a Google Analytics measurement ID, a Meta Pixel, Google Tag Manager, or other code the Creator pastes into the site's settings. A Creator may also add retargeting pixels from Meta, Google, TikTok, Snapchat, or LinkedIn to a creavio short link the Creator creates. Those pixels load on the short link's redirect page before the visitor is sent on. These tags may set cookies and may send visitor data to the companies that provide them. The Creator chooses and controls them, not creavio. creavio is not responsible for the cookie practices of individual Creators' Canvas sites or short links. Visitors to a Creator's Canvas site should review that site's privacy notice if one is provided. Creators who use advertising tracking or analytics cookies on their Canvas sites or short links are solely responsible for compliance with applicable privacy laws, including their privacy notice and obtaining valid visitor consent. A Creator's site shows a cookie banner, and a Google Analytics measurement ID the Creator saves in creavio runs only after a visitor accepts on that banner. Code a Creator pastes into the site's settings and short-link pixels are not controlled by that banner. creavio also provides a Cookie Consent banner component in the canvas editor.
6. HOW TO CONTROL COOKIES
6.1. Browser Settings. You can manage, block, or delete cookies through your browser settings. Instructions vary by browser:
- Chrome: Settings → Privacy and Security → Cookies and other site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions
6.2. Effect of Disabling Essential Cookies. Disabling essential cookies (such as creavio_rt and the sign-in cookies in Section 2.1) will prevent you from signing in to the Platform. This will make it impossible to access your dashboard or any authenticated features.
6.3. Global Privacy Control and Do Not Track. We honor the Global Privacy Control (GPC) signal. When your browser sends it, GA4 does not run, and we treat it as a request to opt out of sale and sharing. creavio does not respond to browser Do Not Track (DNT) signals. Essential cookies are not affected by GPC.
7. CHANGES TO THIS POLICY
We may update this Cookie Policy from time to time. When we do, we post the new version here with a new "Last Updated" date. If a change is material, we will give you notice by email or in the Platform before it takes effect, as the law requires. Other changes take effect when posted.
8. CONTACT
For questions about this Cookie Policy, contact: privacy@creav.io