Cookies and tracking
Version 1.0 · Last updated 4 August 2026
Two different things get confused under this heading, so we describe them separately.
Part one is what our own website stores on your device when you visit capitis.app. That is the cookie question, and the answer is short.
Part two is what happens when a shopper clicks a Capitis tracking link on your site. That one involves no cookies at all, but it does involve personal data, and it is the part that determines what your privacy notice has to say.
Part one — cookies on capitis.app
We use strictly necessary cookies only. No analytics, no advertising, no session recording, no third-party pixels, no tracking of any kind across our marketing site, dashboard or documentation. There is nothing to consent to and no banner, because under the UK Privacy and Electronic Communications Regulations and the EU ePrivacy rules, strictly necessary cookies do not require consent.
| Cookie | What it is for | How long |
|---|---|---|
__Host-authjs.csrf-token | Stops a malicious site submitting a form to us as you (cross-site request forgery protection). Set on every visit, including before sign-in. | Session |
__Secure-authjs.callback-url | Remembers where to send you back to after sign-in | Session |
__Secure-authjs.session-token | Keeps you signed in. Set only after you sign in. | 30 days or until sign-out |
capitis_intro_dismissed | Remembers that you dismissed a first-visit explainer panel, so it does not reappear. Used only when you are not signed in; for signed-in users the same preference is stored in your account instead. | 1 year |
first_run_key | Carries your first API key from the moment your account is created to the screen that shows it to you once. Deleted as soon as it is displayed. | 5 minutes |
All of them are HttpOnly (unreadable by JavaScript), Secure (sent only over HTTPS) and
SameSite=Lax (not sent on cross-site requests). The __Host- and __Secure- prefixes stop
another site on a neighbouring subdomain from writing them.
To remove them, sign out, or clear cookies for capitis.app in your browser. Blocking them entirely will stop sign-in from working. Nothing else on the site depends on them.
We run no third-party scripts. Fonts, styles and images are served from our own domain.
Part two — what a tracking link records
When a shopper clicks a Capitis link on your site, they pass through capitis.app/c/… and are
sent onward to the affiliate network and then to the merchant. That hop takes a few
milliseconds. Here is exactly what happens in it.
We do not set a cookie on the shopper. Not a first-party cookie, not a third-party cookie. Nothing is written to their device by us, and nothing is read from it. There is no local storage, no device fingerprinting, and no script — the redirect is a plain HTTP response.
We do record the click, server-side, as a row in the click ledger:
| Recorded | Why it exists |
|---|---|
| Timestamp | Attribution windows; conversions arrive days or weeks later and must be matched to a click |
| IP address | Fraud and click-farm detection, and deriving the country |
| Country derived from the IP | Geo-eligibility — many merchant programmes only pay on traffic from certain countries |
| User agent (the browser and device string the browser sends) | Fraud detection, and distinguishing mobile from desktop in your reports |
| Referring URL | Which of your pages produced the click — required by some networks for sub-publisher transparency |
| The link, merchant, campaign and label | Reporting, and calculating what you are owed |
| The click token | The reference that ties a later conversion back to this click |
| The identifier attached to the link, if any | Recognising a returning shopper across publishers. Always a hash — see below |
IP address and user agent are personal data. We are not going to describe them as anything else. They are recorded because attribution and fraud detection do not work without them, and because the affiliate networks require us to be able to evidence traffic quality.
Identifiers are never raw. If you attach an identifier to a link, it reaches us as an HMAC-SHA256 hash computed on your side, and we hash it again with a server-side secret before storing it. Details on the Security page.
The click is passed on to the affiliate network. That is the entire point of an affiliate link: the network has to see the click to pay the commission. The network receives the click, the tracking reference, and whatever the shopper's browser sends it directly. The network processes that as an independent controller under its own privacy policy — not as our processor and not as yours. We cannot control or limit what it does with it.
What this means for your privacy notice
You are the controller for your shoppers' data. Your notice needs to cover, in words a normal person understands:
- That links on your site are affiliate links and may earn you a commission.
- That clicking one sends the visitor through a tracking redirect operated by Capitis, which records the click including their IP address and browser information.
- That the click is passed to an affiliate network and to the merchant, who process it for their own purposes.
- Where relevant, that you submit a pseudonymous identifier so a returning shopper can be recognised — and how they opt out or ask for it to be removed.
That is not our preference; it is a contractual requirement flowed down from the networks. Rakuten Advertising's publisher agreement, for example, requires a privacy notice reachable from your home page that discloses tracking devices, the data collection taking place, and the choices available to visitors. See Publisher Policy §4.
Consent
Because nothing is stored on or read from the shopper's device, the UK and EU cookie-consent rules — which govern storage and access on terminal equipment — are not what is engaged here. What is engaged is ordinary data protection law, and you need a lawful basis for the processing. Most publishers running a consent management platform will already be handling affiliate tracking inside it; keep doing that. If a network hands us a specific notice, consent or opt-out specification, we pass it to you and you must implement it.
Opting out
A shopper can ask you to remove any identifier you submitted; you can revoke it instantly from the dashboard or the API and it stops matching from that moment. They can also contact us at privacy@capitis.app, though in most cases we will need to route the request back to you, because a hash on its own does not tell us who someone is.
Questions: privacy@capitis.app
Single.id Limited, 20 Wenlock Road, London, England, N1 7GU — Company Number 17044105