Cookies and visitor storage
Last updated 24 October 2026
This page covers two things: what Pupop stores on your browser when you use pupop.io or the dashboard, and what the Pupop script stores on the browsers of people who visit our customers' websites.
On pupop.io and app.pupop.io
We use cookies to keep you signed in, and Google Analytics cookies to count visits to pupop.io and the sign-in and sign-up pages. Google Analytics doesn't run in the dashboard, and we use no advertising cookies. If you visit from the EEA, the UK or Switzerland, Google Analytics sets no cookies and only counts the visit without them.
| Name | Purpose | Lasts |
|---|---|---|
__Secure-better-auth.session_token | Keeps you signed in to the dashboard | 7 days, renewed while you use it, or until you sign out |
Short-lived better-auth.* cookies | Protect the “Continue with Google” sign-in | Minutes |
_ga | Google Analytics: tells one visitor from another, so we can count visits | 2 years |
_ga_<id> | Google Analytics: keeps track of the current visit | 2 years |
The sign-up form may load Cloudflare Turnstile to check you're not a bot. Checkout and Manage billing happen on Stripe's own pages, under Stripe's cookie policy.
On websites that use Pupop
The Pupop script sets no cookies. It keeps a few small entries in the visitor's browser storage, which never leave the browser except as described in our Privacy policy:
| Key | Storage | Purpose | Lasts |
|---|---|---|---|
pupop:sid | Session storage | A random ID for this browsing session, so each visitor is counted once and spam can be limited | Until the tab is closed |
pupop:ev | Session storage | Which popup events were already sent, so they aren't counted twice | Until the tab is closed |
pupop:cap:<popup> | Local storage | When a popup was last shown, so it respects the frequency the website owner set (for example “once a week”) | Until the visitor clears their browser data |
For customers: describing Pupop in your own notice
You decide whether these entries need consent under the laws that apply to you. In some places, including the EU and UK, storing anything on a visitor's device can need consent unless it's strictly necessary. If you need wording, you can adapt this:
This website uses Pupop to show popups. Pupop stores a random session ID and a record of which popups you've seen in your browser's storage. It does not use cookies or store your IP address. If you fill in a popup form, your details are sent to us through Pupop. See pupop.io/privacy.
Clearing it
Visitors can remove these entries at any time by clearing site data for that website in their browser settings. Closing the tab removes the session entries.
Contact
Halfborg Software · UEN 53254612A · Singapore · privacy@pupop.io