Cookie Statement
Last Updated: October 18, 2026
This Cookie Statement explains how Kikinda LLC ("Kikinda," "42min.us," "we," "us," "our") uses cookies and similar technologies on our website at 42min.us and the 42min Service. It supplements our Privacy Policy.
1. What Are Cookies?
Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work, improve performance, remember preferences, and provide analytics. Similar technologies include local storage, session storage, pixels, web beacons, and SDKs. In this Statement, "Cookies" refers to all of these.
2. Categories of Cookies We Use
We organize Cookies into four categories:
- Strictly Necessary: required for the Service to operate and cannot be turned off (login session, security, theme preference). These do not require consent.
- Functional: remember choices you make to enhance your experience (language, time-zone, preferences). May require consent in some jurisdictions.
- Analytics: help us understand how the Service is used, identify problems, and improve features. Requires consent in the EEA, UK, Switzerland, and similar jurisdictions.
- Marketing / Advertising: used to measure the effectiveness of our marketing and to deliver relevant content. Requires consent, except for strictly first-party items that involve no third party and no cross-site tracking (see Section 4.D).
Organizations that use 42min can also add their own analytics and advertising tags (Google Analytics, Google Ads and the Meta Pixel) to their public pages on 42min.us. Those tags belong to the organization and need your consent. Section 4.E describes them.
3. Your Choices
When you use the 42min application, we display a Cookie consent banner before any non-essential Cookies are set. You can:
- Accept: analytics Cookies and session replay start;
- Decline: no analytics Cookies are set, and any previously set analytics Cookies are removed.
Your decision is remembered for 12 months, after which the banner asks again. You can also control Cookies through your browser settings. Most browsers let you block, delete, or be notified about Cookies, and clearing our site data resets your recorded decision. To withdraw consent at any time, email plus@42min.us. Our marketing website sets no analytics Cookies and shows no banner, though it does store two first-party attribution values, described in Section 4.D.
On an organization's pages. When an organization has added analytics or advertising tags to its landing page, team pages, booking pages or routing forms, those pages show a small card before any tag loads. The card names the organization and the platforms it uses, links to this Statement, and offers Decline and Accept. Accept loads those platforms on that organization's pages. Decline loads nothing and stores only your decision. Your decision is stored in your browser for that organization only and lasts 12 months. If the organization later adds a platform you have not accepted, the card asks again on the pages that use it. Pages of organizations without such tags show no card.
The card has no permanent settings link. To change your decision before it expires, clear the site data for 42min.us in your browser's settings: this removes your recorded decisions and the platforms' Cookies on 42min.us, and the card asks again on your next visit. Clearing site data also signs you out of the 42min application and resets your decision on its banner. Otherwise the card asks again once your decision is 12 months old.
We honor Global Privacy Control (GPC) signals as a request to opt out of non-essential Cookies and any "sale" or "sharing" of personal information. If your browser sends a GPC signal and you have not made a choice on the banner, we treat it as a decline; an explicit Accept you give on the Service takes precedence, consistent with the GPC specification. The same applies on organizations' pages: with a GPC signal and no decision recorded for that organization, the card is not shown and none of its tags load.
4. Cookies We Use
The tables below describe the Cookies we use. We update this list as the Service changes. If you find a discrepancy, email plus@42min.us so we can correct it.
Note for readers: specific cookie names below may change between releases. Authoritative names are visible in your browser's developer tools (Application → Cookies / Local Storage) when you visit our domains. The categories and purposes described here remain stable.
A. Strictly Necessary
| Cookie / Technology | Purpose | Type | Duration |
|---|---|---|---|
__Host-42min_at | Holds your access token, which proves who you are on each request the 42min application makes. It is HttpOnly, so scripts on the page cannot read it. | First-party HTTP cookie | 15 minutes |
__Host-42min_rt | Holds your refresh token, which renews the access token while you keep using the application. It is HttpOnly. | First-party HTTP cookie | 7 days, extended each time your session is renewed |
__Host-42min_session | Records which account and which sign-in this browser holds, so every open tab can tell whether you are still signed in. It holds your user and session identifiers and cannot sign anyone in by itself. Deleting it signs this browser out. | First-party HTTP cookie | 7 days, extended each time your session is renewed |
__Host-42min_oauth | Ties a Google or Microsoft sign-in to the browser that started it, so a sign-in link opened in another browser does nothing. It is HttpOnly. | First-party HTTP cookie | 10 minutes |
42min_refreshed_at (local storage) | Records when your session was last renewed, so several open tabs do not renew it at once | Local storage | Persistent until cleared |
theme (local storage) | Remember light/dark theme preference | Local storage | Persistent until cleared |
Cloudflare security cookies, such as __cf_bm and cf_clearance | Set by Cloudflare, our network and security provider, only when its bot or challenge protection checks a request, to remember that your browser passed the check. They hold no account information, and 42min does not read them. | First-party HTTP cookie, set by Cloudflare, Inc. | 30 minutes by default |
B. Functional
| Cookie / Technology | Purpose | Type | Duration |
|---|---|---|---|
| Language / locale preference | Display the Service in your preferred language | First-party | 12 months |
| Time-zone preference | Render times in your zone | First-party | 12 months |
lastLoginEmail (local storage) | Remembers the email address you last signed in with, to fill in the sign-in form and to let our marketing website show My Account instead of Get Started Free | Local storage | Persistent until cleared |
| Cookie consent record | Remember your Cookie preferences | First-party | 12 months |
C. Analytics
| Cookie / Technology | Purpose | Provider | Duration |
|---|---|---|---|
ph_<project-key>_posthog | Stores a pseudonymous analytics identifier and session state so we can count unique users, measure feature usage, and analyze funnels. Status: active after consent. | PostHog, Inc. (PostHog US Cloud) | 12 months |
ph_<project-key>_window_id, related session keys (session / local storage) | Groups events belonging to the same browsing session and browser tab. Status: active after consent. | PostHog, Inc. (PostHog US Cloud) | Session (window ID) / up to 12 months |
| Session replay: PostHog recorder script plus the session identifier above | Records a reconstruction of your interaction with the 42min interface (mouse movement, clicks, scrolling, navigation and console errors), so we can diagnose bugs and usability problems. Input masking is enabled: passwords, form fields and text you type are suppressed before the recording leaves your browser. Status: active after consent. | PostHog, Inc. (PostHog US Cloud) | Recordings deleted after 30 days |
Status and consent: PostHog product analytics and session replay are consent-gated on the Service. When you use the 42min application, a consent banner asks before any of these technologies start. Nothing is stored or recorded unless you choose Accept, and your decision is remembered for 12 months. We honor the Global Privacy Control (GPC) signal: if your browser sends it, we treat it as a declined banner and analytics never starts. Declining also removes any previously set PostHog Cookies. Public booking pages set none of our analytics Cookies; the tags an organization may add to its own pages are described in Section 4.E. When collected, data is processed by PostHog, Inc. on PostHog US Cloud (United States) as our processor, under written data-protection terms including the EU Standard Contractual Clauses. You can also block Cookies with your browser's controls, or email plus@42min.us with questions or to withdraw consent. We do not use Google Analytics to measure the Service. An organization may use it on its own pages (Section 4.E).
More about session replay. Replay is a form of behavioral monitoring, so we are explicit about its limits. We record only pages of the 42min website and Service, never other sites or applications. Sensitive inputs are masked at capture time and never reach PostHog's servers. We do not use replay to monitor the productivity or conduct of individual employees, we do not sell or share recordings, and we do not combine them with advertising data. Recordings are automatically deleted after 30 days. You may object to replay at any time, or request deletion of recordings associated with you, by emailing plus@42min.us. See Section 12 of our Privacy Policy for your full rights.
D. Marketing / Advertising
| Cookie / Technology | Purpose | Provider | Duration |
|---|---|---|---|
firstFrom (local storage, marketing website) | Records which channel first brought you to 42min.us: a ?from or ?ref tag we or a partner put on a link, a utm_source value, or the site that referred you, so that if you later create an account, the signup can be credited to that channel. Where the referring site is a link wrapper, we store the platform it stands for (for example gmail rather than google.com). It holds a channel name only: no page history, no profile, no identifier. Set once, on your first page, and never revised. Status: active. | Kikinda LLC (first-party) | Persistent until cleared |
firstLanding (local storage, marketing website) | Records the first page of our marketing website you arrived on: the path only, such as /compare/calendly, never the query string, so we can see which pages bring people in. Like the value above it is set once, on your first page, and never revised. Status: active. | Kikinda LLC (first-party) | Persistent until cleared |
| Conversion / retargeting pixels | Measure ad-campaign effectiveness; retarget visitors | TBD (e.g., Google Ads, Meta, LinkedIn, Reddit) | TBD |
Status: This category covers 42min's own marketing. On our own pages, meaning our marketing website and the 42min application, no third-party marketing or advertising Cookies are active as of the Last Updated date: no ad-network pixels, no retargeting tags, and nothing that follows you to another site. Organizations' own pages can carry advertising tags the organization chooses, after your consent (Section 4.E). The firstFrom and firstLanding values above are the only active items in this category. We set them on our own marketing website, we are the only ones who read them, and they are never shared with an advertising network; between them they record the name of a channel and the page you arrived on, rather than anything about you, and cannot be used to recognize you elsewhere. On that basis we set them without a banner. You can remove them at any time by clearing site data for 42min.us in your browser. We may add third-party marketing Cookies in the future and will update this Statement and request consent before placing them in jurisdictions where consent is required.
E. Analytics and Advertising Tags Chosen by Organizations
An organization that uses 42min can add Google Analytics 4, Google Ads conversion tracking and the Meta Pixel to its own public pages on 42min.us: its landing page, team pages, booking pages and routing forms. The organization decides whether to use them and which of its Google or Meta accounts receive the data, and it is responsible for that use. We load the tags on its instructions. Google and Meta process what they receive under their own terms and privacy policies. Section 3 of our Privacy Policy explains these roles.
When they load. Only after you choose Accept on that organization's card (Section 3). Until then nothing from Google or Meta loads, and none of the Cookies below is set. The tags never run on single-use booking links, Roundtable pages, cancel, reschedule or payment pages, or the booking confirmation page. They never run inside a booking page or routing form embedded in another website either (Section 4.F).
What 42min sends them. After you accept, the page loads the platforms' own scripts from Google's and Meta's servers, set up with the organization's account IDs. 42min then reports these events to them:
- a page viewed: a landing or team page, a booking page, or a routing form;
- the steps of a booking: a date and a time picked, the booking form started and sent, the booking confirmed or requested, a visitor screened out by qualification questions, and a paid booking leaving for checkout;
- the steps of a routing form: started, sent, and routed to its destination.
The events carry the names of the event type, team and form, the meeting's length, the page's language, a booking ID, and the price and currency of a paid booking. They never carry your name, email address, phone number, answers, notes or guests, or any link that lets someone manage your booking. Before the scripts load, the page's address is cleaned so that only campaign parameters (such as utm_source or gclid) and the language remain in it.
Hashed contact details. If the organization turns on Enhanced conversions (Google Ads) or Advanced matching (Meta), both off by default, the page also sends that platform a hashed form of your email address, and of your phone number when the form asked for one, with a confirmed or requested booking or a sent routing form. The hash is a SHA-256 value computed in your browser, and it is sent only after you accept. Google and Meta use it to match the booking to an account on their services, so the organization can measure its ads.
What the platforms collect by themselves. As on any website, Google's and Meta's scripts also collect information on their own: your IP address, browser and device details, the page's address and the page you came from, and the identifiers in their Cookies. An organization can also turn on settings in its own Google or Meta account that collect contact details, such as an email address you type, from the page itself: user-provided data collection in Google Analytics, automatic detection in the Google tag, and automatic advanced matching in Meta's Events Manager. 42min does not control those settings. Whether they are on is the organization's choice and responsibility.
| Cookie / Technology | Purpose | Provider | Duration |
|---|---|---|---|
x42min_analytics_consent (local storage) | Records your decision on each organization's card: accepted or declined, for which platforms, and when. It holds no identifier and is not sent to us or to anyone else. | Kikinda LLC (first-party) | 12 months for each decision |
<prefix>_ga, <prefix>_ga_<id> | Tell visitors and sessions apart in the organization's Google Analytics property. Status: active after Accept, on pages that use Google Analytics. | Google, for the organization | 2 years (Google's default) |
<prefix>_gcl_au, and related _gcl_ Cookies such as <prefix>_gcl_aw when you arrive from a Google ad | Link a booking to the ad that brought you, for the organization's Google Ads conversion measurement. Status: active after Accept, on pages that use Google Ads. | Google, for the organization | 90 days (Google's default) |
_fbp, and _fbc when you arrive from a Meta ad | A browser identifier and the ad click identifier for the organization's Meta Pixel. Status: active after Accept, on pages that use the Meta Pixel. | Meta, for the organization | 90 days (Meta's default) |
| Cookies on Google's and Meta's own domains, such as google.com, doubleclick.net and facebook.com | Set by Google and Meta for their own purposes, such as recognizing an account you are signed in to and measuring and delivering ads, under their own policies. | Google, Meta | Set by Google and Meta |
<prefix> stands for x42 followed by ten characters unique to the organization, so two organizations' Google accounts never share a Cookie on 42min.us. Meta's Cookies take no prefix. Every organization that uses the Meta Pixel on 42min.us shares them, so Meta sees the same browser identifier on each of those organizations' pages, while each organization's pixel receives only that organization's events.
To learn how Google uses this information and to control the ads it shows you, see Google's page on how Google uses information from sites that use its services and My Ad Center. Google also offers a browser add-on that blocks Google Analytics on every website. For Meta, see Meta's Privacy Policy and the ad preferences in your Meta account. For what an organization does with its data, see that organization's own privacy notice or contact it.
F. Embedded Content / Connected Services
When you connect to or interact with third-party services through 42min (e.g., Google Calendar, Google Meet, Microsoft 365 / Outlook, Pipedrive, Stripe), those services may set their own Cookies under their own privacy and cookie policies. We do not control those Cookies. When a booking requires payment, you pay on Stripe's own checkout page, which may set Stripe's Cookies under Stripe's policies. No Stripe script runs on 42min.us.
An organization can embed its booking page or routing form in its own website. The embedded page runs none of the tags in Section 4.E and shows no card. It passes the events listed there to the website around it, which may send them on to its own analytics or advertising tools. The hashed contact details described in Section 4.E are passed too, but only when the organization has turned them on and only to websites it lists as its own. What happens on that website is governed by its own privacy and cookie policies and its own consent tools.
5. Do Not Track and Global Privacy Control
Our response to "Do Not Track" browser signals may vary depending on context and legal requirements. We honor Global Privacy Control (GPC) signals. In the 42min application, a GPC signal declines our analytics when you have not answered the banner (Section 3). On an organization's pages, a GPC signal declines that organization's analytics and advertising tags when you have no decision recorded for it: the card is not shown and none of the tags load (Section 4.E). A website that embeds a booking page applies its own policy to GPC.
6. Changes to This Statement
We may update this Cookie Statement to reflect changes in our practices or applicable law. Material changes will be communicated via the Service. The "Last Updated" date indicates the date of the most recent revision.
7. Contact
For questions about Cookies, email plus@42min.us.