Last updated: 6 October 2026
Cookies are small text files a website stores in your browser. Local storage and session storage do a similar job without being sent to the server on every request. This page lists everything of either kind that HikrLink uses: in the dashboard, on bio pages and short links at hikrl.ink, and on our website at hikrlink.com. Our Privacy Policy explains what happens to the data.
| Name | Purpose | Duration | Type |
|---|---|---|---|
| __Secure-next-auth.session-token | Keeps you signed in. A large session may be split into parts ending .0, .1. | Up to 30 days. Without “Keep me signed in”, the sign-in it holds expires after 1 day. | First party, essential |
| __Host-next-auth.csrf-token | Protects sign-in forms against cross-site request forgery. | Session | First party, essential |
| __Secure-next-auth.callback-url | Returns you to the right page after signing in. | Session | First party, essential |
| __Secure-next-auth.state, __Secure-next-auth.pkce.code_verifier | Secures the Sign in with Google flow. Set only while it runs. | 15 minutes | First party, essential |
| MYNEXTAPP_LOCALE | Remembers the language you chose. | 1 year | First party, functional |
| hk_consent | Remembers whether you accepted or declined the Meta Pixel. | 180 days | First party, essential |
| _fbp | Set by the Meta Pixel to recognise your browser across visits. Only after you accept. | 90 days | First party, set by Meta; advertising |
On a local development copy the NextAuth cookies drop their
__Secure- and __Host- prefixes; they
are otherwise the same.
| Name | Purpose | Duration | Type |
|---|---|---|---|
| theme | Remembers light or dark mode. | Until cleared | Local storage, functional |
| onboarding-completed-steps | Remembers which getting-started steps you finished. | Until cleared | Local storage, functional |
| hkrl:claimToken | Lets you claim a link you created on hikrlink.com before signing up. | Until claimed or cleared | Local storage, essential |
| hikrlink:checkout-claim | Connects a checkout to the account it creates. | Until the tab closes | Session storage, essential |
HikrLink's own Meta Pixel measures sign-ups, checkouts and
purchases. It loads only after you accept it in the consent
prompt. Once it loads, Meta sets _fbp on our domain
and may set its own cookies on facebook.com, as described in
Meta's cookie policy.
If you decline, nothing from Meta loads. To change your choice,
clear the hk_consent cookie and the prompt appears
again.
On the billing and checkout pages, Paddle's payment script loads and may set its own cookies for payment security and fraud prevention. See Paddle's privacy policy.
Bio pages and short links set no HikrLink cookies. A bio page may
use a Meta Pixel, the page owner's or HikrLink's own, and
it loads only after the visitor accepts it in the consent prompt,
which stores the choice in hk_consent for 180 days.
Once loaded, Meta sets _fbp as above.
A short link may fire the link owner's own Meta Pixel. That pixel belongs to the link owner, who is responsible for telling their visitors and for any consent it requires.
The website sets no cookies. It uses browser storage only for Google Analytics, and only once you accept it in the consent banner:
| Name | Purpose | Duration | Type |
|---|---|---|---|
| hk_consent | Remembers whether you accepted or declined Google Analytics. | 180 days | Local storage, essential |
| _hkga | A random visitor identifier (local storage) and visit identifier (session storage) for Google Analytics. Only after you accept. | Until cleared / until the tab closes | Local and session storage, analytics |
Google Analytics on this site loads no Google script. Page views are sent to an address on our own domain, which forwards them to Google Analytics. Hikr, our own measurement tool, runs without cookies or device storage. Fonts come from Google Fonts, which sets no cookies but does receive your IP address.
You can decline the Meta Pixel and Google Analytics in their consent prompts and everything still works. You can also block or delete cookies and storage in your browser settings. Blocking the essential cookies in section 2 will sign you out of the dashboard and stop it working.
For questions about cookies, email privacy@hikrlink.com.
We use Google Analytics to count visits. It stores a random identifier in your browser. Our own measurement, Hikr, stores nothing on your device. You can decline and the site works the same. Privacy