Cookie Policy
Last updated: October 22, 2026
1. Who we are and what this policy covers
Clikr is operated by Mawal AB, a Swedish private limited company (aktiebolag) registered under organization number 559279-0462, with its registered office at Hallandsgatan 38, 118 57 Stockholm, Sweden.
This policy explains the cookies and similar storage technologies used on www.clikr.app and how you can control them. How we handle personal data more generally is described in our Privacy Policy. If you have questions about cookies, you can reach us at hello@clikr.app.
Where noted, it also covers what the Clikr browser extension stores on your computer for automatic pairing (see Stored by the Clikr browser extension in section 4).
2. What cookies and similar technologies are
A cookie is a small text file a website asks your browser to store on your device and reads back on later visits or page loads. A cookie set under our own domain is a first-party cookie. A cookie set under another company's domain, when that company's code runs on the page, is a third-party cookie. A session cookie is deleted when you close your browser; a persistent cookie stays until it expires or you delete it.
Browsers also offer other ways to store and read information on your device. Clikr uses two of them. Local storage and session storage are key-and-value stores in your browser: local storage persists until it is cleared, while session storage is cleared when the browser tab closes. We also store sign-in state in IndexedDB, a structured store in the browser. The Clikr browser extension also keeps a few entries in its own storage in your browser, which websites cannot read.
The same consent rules apply to all of these technologies, not only to classic cookies. This policy uses "cookies" as shorthand for cookies, local storage, session storage, and IndexedDB together, and for the extension's own storage where section 4 describes it.
3. Why we use cookies and how we ask for consent
Clikr turns your phone into a wireless laser pointer for presentations. We use cookies and similar storage to run the service, to keep you signed in, whether to the anonymous account the pairing screen creates on your phone or to your own account, to remember your cookie choices, and to help us find and fix errors. We do not currently use advertising or cross-site tracking cookies, though we expect that to change as the service grows (see the Targeting category below).
Strictly necessary cookies and storage are set without asking for consent, because they are needed to provide the service you explicitly requested. For every other category, we ask for your consent first.
When you first visit the site, a consent banner appears. Its first layer lets you choose "Accept All", "Deny All", or "Customize". Rejecting is as direct as accepting: both are buttons on that first layer. "Customize" opens a panel with three categories, Essential, Performance, and Targeting. Essential is always on and cannot be switched off. Performance and Targeting are not pre-selected; you turn them on yourself if you want them. Your choice is saved in a strictly necessary cookie and a matching local-storage entry (both named cookie-consent) so the service can honor it and so we can show that consent was given. We may ask again periodically, and we will ask again if our use of non-essential cookies changes in a material way.
You can change or withdraw your consent at any time. Section 6 explains how.
4. The cookies and storage we use, by category
The set of cookies and storage can change as the service evolves and as the third-party providers below update their own technologies. The live, current set is always visible in your browser's developer tools, under the Application or Storage tab. The tables below were verified against the codebase and product documentation.
Strictly necessary
These are needed to deliver the service you asked for, so they are set without asking for consent. Among other things, they remember your cookie-consent choice, keep you signed in, whether to the anonymous account the pairing screen creates on your phone or to your own account, let a presentation continue when you reload or return to the page, let Paddle complete a purchase you started, and, once you choose to buy, protect Paddle's payment service against automated abuse. Blocking them in your browser may break parts of the service, including sign-in and checkout, and can make resuming a presentation unreliable.
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| cookie-consent | Clikr (first-party) | Stores your cookie-consent choice and the policy version | Cookie | 365 days |
| cookie-consent | Clikr (first-party) | Stores your cookie-consent choice, the policy version, and the time you made it | Local storage | Until cleared |
| Firebase Authentication state | Google Firebase (first-party storage in your browser) | Keeps you signed in between page loads, whether to the anonymous account the pairing screen creates on your phone or to your own account | IndexedDB, falling back to local storage | Until you sign out or clear site data. An anonymous sign-in has no sign-out control, so it stays until you sign in on that browser or clear its site data. Once that anonymous account has been deleted after 180 days without use (see the Privacy Policy), your next visit in that browser removes it |
| Paddle checkout cookies | Paddle (third-party), set on Paddle's own domain | Runs the checkout flow and helps prevent fraud when you open the Paddle checkout to buy Pro | Cookie | Set and controlled by Paddle |
| __cf_bm | Paddle (third-party), set on Paddle's own domain by Cloudflare, a provider Paddle relies on | Protects Paddle's payment service against automated traffic, using Cloudflare's encrypted score of how likely a visit is to be automated. Set when Paddle's script loads, which happens only when you choose to buy (when you click a button to buy or upgrade to Pro, or open a checkout link from us or Paddle), as part of the checkout you asked for | Cookie | 30 minutes after your last request to Paddle |
| presenter-settings | Clikr (first-party) | Remembers your in-app pointer settings (color, trail effect) so they persist across sessions | Local storage | Until cleared |
| presenter-session-id | Clikr (first-party) | Holds the ID of the presentation session this tab most recently opened, so that reloading the tab, going back to it, or signing in and coming back can pick the session back up instead of ending the presentation | Session storage | Until the tab closes |
| presenter-session-channel | Clikr (first-party) | When the session this tab opened is a connection to a paired computer, holds that session ID together with the ID of the pairing channel it was reached through, so that reloading the tab or coming back to it reconnects only to that same computer | Session storage | Until the tab closes |
| presenter-session-qr-channel | Clikr (first-party) | When this tab was opened from a computer's pairing QR code, holds the session ID from that code together with its pairing channel ID, so that if the connection fails after the tab reloads or after you sign in, the offer to reconnect names the computer whose code you scanned and not another of your paired computers | Session storage | Until the tab closes |
| presenter-auth-redirect | Clikr (first-party) | Notes that you left the app to sign in with Google, and whether you were presenting at the time, so that if the sign-in sends you back to a presentation the tab picks it up again instead of ending it. It holds only a timestamp and that yes-or-no, never the session ID and never a page address. It is deleted the first time it is read, and ignored if more than ten minutes have passed | Session storage | Until it is read, or until the tab closes |
| presenter-has-presented | Clikr (first-party) | Remembers that you have started presenting in this tab, so the first-run help overlay does not open by itself over your presentation, even after the tab reloads. It holds only a yes-or-no value, never the session ID | Session storage | Until the tab closes |
| presenter-onboarding-seen | Clikr (first-party) | Suppresses the first-run help overlay after you have seen it | Local storage | Until cleared |
| presenter-install-hint-dismissed | Clikr (first-party) | Remembers that you dismissed the line suggesting you add Clikr to your home screen, so it does not come back | Local storage | Until cleared |
| clikr.trial.countdown-banner-dismissed | Clikr (first-party) | Remembers that you closed the trial-countdown banner so it does not reappear within the same browsing session | Session storage | Until the tab closes |
| clikr.trial.expired-banner-dismissed:<ts> | Clikr (first-party) | Remembers that you closed the trial-expired banner. Keyed by the timestamp at which your trial was used so a fresh trial for the same browser starts with the banner re-enabled | Local storage | Until cleared |
| presenter-signup-email-updates-pending | Clikr (first-party) | When you tick the email updates box while signing up with Google and the sign-in reloads the page, carries that choice across the reload so it is recorded for your new account. It holds only a yes value and is deleted the first time it is read | Session storage | Until it is read, or until the tab closes |
| presenter-email-verified-notified:<uid> | Clikr (first-party) | Notes that our server has already been told your email address is verified, so this browser tells it only once. Its name ends in your account identifier; it holds only a yes value | Local storage | Until cleared |
| presenter-reset-code | Clikr (first-party) | Holds the code from the password-reset link we emailed you, moved out of the address bar so our error monitoring and analytics never record it; used only to reset your password | Session storage | Until the link is used or turns out to be invalid or expired, or until the tab closes |
| presenter-verify-code | Clikr (first-party) | Holds the code from the verification link we emailed you, moved out of the address bar so our error monitoring and analytics never record it; used only to verify your address | Session storage | Until the link is used or turns out to be invalid or expired, or until the tab closes |
Stored by the Clikr browser extension
The Clikr browser extension keeps the entries below in its own storage on your computer. They are not cookies, websites cannot read them, and the cookie banner on our website does not control them. They are the entries that automatic pairing adds, described under "Automatic pairing data" in our Privacy Policy, not everything the extension stores. Removing the extension deletes all of them.
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| channelId | Clikr browser extension | A random code for this installation of the extension. It is created only when a phone signed in with Clikr Pro or a Pro free trial, with Connect without scanning switched on, asks the extension to pair. An installation that never pairs this way has none. From then on it is carried in the pairing QR code the extension shows, and in the link behind it, and the extension saves it in our database as the record that phone connects through. It is strictly necessary for the automatic pairing that phone's owner asked for. If its record in our database turns out to be held by another account, the extension replaces it with a new code | Extension storage | Until the extension is removed |
| pairingToken | Clikr browser extension | The Clikr account identifier of the phone that paired with this extension through automatic pairing. It is stored only after the owner of that phone, signed in with Pro or a Pro free trial, switched Connect without scanning on, and it is needed for the automatic pairing that switch turns on: it is what lets that phone connect again without scanning. While it is stored, the session identifier the extension saves for its current session contains the same account identifier | Extension storage | Until you unpair in the extension, another account pairs with it, that account connects to it with Connect without scanning switched off, or the extension is removed |
| pairingChannelPublished, channelRotatedAt, pairingRescanNeeded | Clikr browser extension | Bookkeeping for automatic pairing: whether this installation has saved its pairing channel record, when it last replaced its code, and whether paired phones need to scan its QR code again. They hold only yes-or-no values and a time, no identifiers, and are never sent anywhere | Extension storage | Until the extension is removed; the scan-again marker until a phone pairs again or you unpair |
Performance
Performance technologies help us understand how the site is used and find errors so we can fix them. They are not strictly necessary. Where one of them stores or reads anything on your device, we keep it behind your Performance consent choice. The category also covers a counter the app keeps on your phone to time a one-time request to rate Clikr in the extension stores.
Why Vercel Analytics runs without a consent banner
We use Vercel Analytics for aggregated usage statistics such as page views and visitor counts, plus a small set of custom product events that the app sends about feature use, about how pairing went, when the browser extension is installed, when a link to an extension store is opened, and when a request to rate Clikr is shown. Vercel Analytics is built to be cookieless, and we do not put it behind the consent banner. Here is the basis for that, so you can check it rather than take our word for it.
- It sets no cookies and uses no browser storage. The script we serve uses none of the browser storage APIs: no cookies, no local storage, no session storage, and no IndexedDB. That is why there is no entry for it in the table below. The first-visit and rating-request entries there are written by our own app, not by this script, and only with your Performance consent.
- There is no persistent or cross-site identifier. The value Vercel uses to count unique visitors is computed on their servers from the incoming request and discarded after 24 hours. Nothing that identifies you is kept on your device or carried from one site to another.
- It measures our own audience, in aggregate. We use it to see which pages are used and whether pairing works. We do not use it for advertising or profiling, we do not build a profile of you from it, and we do not combine it with your account.
Taken together, those points are why we do not ask you to consent to it separately: it is aggregate first-party measurement, there is no identifier that follows you between sites or between visits, and nothing here is built into a profile of you or used to target you. That is a judgment about how little this collects and what it is used for. It is not a claim that the rules on storing and reading information on your device are irrelevant, and it is our own assessment of our own product, and not a statement by Vercel. The processing of the data Vercel Analytics does receive, such as the visited page address and a coarse country derived from the request IP, has its lawful basis, its retention period, and your right to object set out in our Privacy Policy, and you can object there without it affecting anything else.
We also use Sentry for error monitoring on the production site. Sentry includes a session-replay feature in error-buffer mode. The replay feature does not record video of your screen. It captures the page content and your interactions, such as clicks and scrolling, and reconstructs them so we can see what led to an error. In production, text is masked and media is blocked in those reconstructions. The reconstruction is held only in your browser and is sent to Sentry only if an error occurs.
The Sentry session-replay component is a non-essential performance technology, so it is gated behind your Performance consent choice. It does not start, and it writes nothing to your browser's storage, until you allow the Performance category in the consent banner. If you later withdraw that consent, the replay stops. Error monitoring itself runs regardless of this choice because it stores nothing on your device. It records error details so we can find and fix faults, and also diagnostic messages we send deliberately when nothing has failed, for example when pairing succeeded but took longer than expected.
To learn which channels bring people who go on to use Clikr, the app also notes where you first came from: a campaign tag in the link you followed, or a broad category of the site that sent you, such as a search engine or a social network, and never that site's address. If you answer the welcome page's optional question about how you heard about us and the link you followed carried no campaign tag, the label is your answer instead of the broad category. It sends that label once, with the custom product event for your first successful pairing, once with the event the welcome page sends when you first install the browser extension, and once with the event it sends if you answer its optional question about how you heard about us. It keeps the label, together with your answer if you gave one, and a note that the first-pairing event was sent, in your browser's local storage only if you allow the Performance category, and removes them if you withdraw that consent. Without that consent the label and your answer are kept only in the open page and are gone when you leave it.
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
| Sentry replay-session identifier | Sentry (third-party), production site only | Identifies a session-replay buffer so an error reconstruction can be sent if an error occurs; written only after you allow the Performance category | Session storage | Session (cleared when the tab closes) |
| clikr.first-touch | Clikr (first-party) | Remembers where you first came from, so the first-pairing and extension-installed events report the same source on a later visit: a campaign tag from the link you followed, or a broad category of the site that sent you, and when, and your answer to the welcome page's optional question about how you heard about us, if you gave one. It holds no identifier and never that site's address; written only after you allow the Performance category | Local storage | Until cleared, or until you withdraw Performance consent |
| clikr.first-pairing-sent | Clikr (first-party) | Notes that the first-pairing event was already sent from this browser, so it is not sent again. It holds only a yes value, no identifier; written only after you allow the Performance category | Local storage | Until cleared, or until you withdraw Performance consent |
| presenter-rating-connects | Clikr (first-party) | Counts the connections this phone has made to your computer so that, after the fifth, we can ask once whether you would rate Clikr in the Chrome Web Store or on Firefox Add-ons. It holds only a number; written only after you allow the Performance category | Local storage | Until cleared, or until you withdraw Performance consent |
| presenter-rating-prompt-done | Clikr (first-party) | Remembers that the rating request has been shown on this phone, so it is not shown again; written only after you allow the Performance category | Local storage | Until cleared, or until you withdraw Performance consent |
Targeting
The consent banner offers a Targeting category for advertising and campaign-measurement cookies. Clikr does not set any Targeting cookies today, so there are none to list here yet. We expect this to change: as Clikr grows, we plan to advertise it on third-party platforms and to measure how well those campaigns perform, which would involve advertising or conversion-measurement cookies in this category. Any such cookie will be gated behind your Targeting consent, and we will update this policy and the consent banner before it is set.
5. Third parties that set cookies through Clikr
Third-party cookies and storage are governed by the third party's own cookie and privacy notices, and we do not control them. The third parties involved are:
- Google Firebase stores your sign-in state in your browser so you stay authenticated. Firebase privacy and security.
- Sentry provides error monitoring and session replay on the production site, through an EU ingest endpoint. Sentry privacy policy.
- Paddle, our Merchant of Record, operates the checkout. Paddle's script loads only when you choose to buy, that is when you click a button to buy or upgrade to Pro or open a checkout link from us or Paddle, and Cloudflare, a provider Paddle relies on, then sets the __cf_bm cookie on Paddle's domain. When you open the Paddle checkout to buy Pro, Paddle sets its own cookies on its own domain for the checkout flow and fraud prevention, along with cookies set by the providers Paddle relies on to run the checkout. None of these land on the Clikr domain. Paddle privacy notice.
6. How to manage, change, or withdraw your consent
To change your choices, click the cookie icon in the bottom-left corner of any page except the presenter screen. This clears your saved consent and reopens the banner, so you can accept all, deny all, or pick categories again. On the presenter screen, where that icon would cover the controls, open Help and choose Cookie settings instead. You can also clear your browser's cookies and local storage to reset your choices.
You can change or withdraw your consent at any time. Doing so is as easy as giving consent in the first place. Withdrawing consent does not affect the lawfulness of anything we did based on your consent before you withdrew it.
Your browser can also block or delete cookies and clear site storage, usually from its privacy or site-data settings. Blocking strictly necessary cookies and storage may break parts of Clikr, including sign-in and checkout, and can make resuming a presentation unreliable.
7. Do Not Track and Global Privacy Control
Clikr does not respond to the browser Do Not Track (DNT) signal, because there is no common, agreed standard for how a site should act on it.
Global Privacy Control (GPC) is a browser signal that asks a site to opt you out of the sale or sharing of your personal information. We do not currently detect or act on the GPC signal on the server. As section 8 explains, Mawal AB does not sell or share personal information through cookies, so there is nothing for a GPC signal to switch off.
8. US state privacy rights and cookies
Some advertising and tracking cookies share information with third parties, and US state privacy laws such as the California Consumer Privacy Act (CCPA) can treat that as a "sale" or "sharing" of personal information. The CCPA's obligations, including the duty to honor a Global Privacy Control signal, bind businesses that meet its thresholds.
Mawal AB is not a covered business under the CCPA, and it does not sell or share personal information through cookies as those terms are used under US state privacy law. Clikr runs no advertising or cross-context tracking cookies. We honor the privacy rights described here voluntarily, on the same basis as our Privacy Policy. If we ever introduced cookies that amounted to a sale or sharing, we would honor a valid Global Privacy Control signal as an opt-out and provide a way to opt out. Our Privacy Policy carries the full account of US state privacy rights.
9. How cookies relate to your personal data
Some of the cookies and storage described here process personal data, such as online identifiers or your IP address. How we handle personal data, the legal bases we rely on, who we share it with, how long we keep it, and the rights you have are described in our Privacy Policy.
10. Changes to this Cookie Policy
We may update this policy as Clikr evolves. The "Last updated" date at the top reflects the most recent change. When the set of non-essential cookies changes in a material way, we bump the stored consent version, which prompts the banner to ask for your consent again before the new cookies are set.
11. How to contact us and complain
Questions about this policy can be sent to Mawal AB at hello@clikr.app, or by post to Hallandsgatan 38, 118 57 Stockholm, Sweden.
If you think our use of cookies or similar technologies does not respect your rights, please contact us first at hello@clikr.app so we can help. You also have the right to complain to a supervisory authority. In Sweden, the authority for the cookie-consent rule is the Swedish Post and Telecom Authority (Post- och telestyrelsen, PTS) at pts.se, and the authority for data protection is the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY) at imy.se. If you are in another EU or EEA country, you can complain to your national data protection authority, which you can find through the European Data Protection Board directory at edpb.europa.eu. If you are in the United Kingdom, you can complain to the Information Commissioner's Office at ico.org.uk/concerns. If you are in California, you can also contact the California Privacy Protection Agency at cppa.ca.gov.