Cookie Policy

Cookies are small text files stored in your browser. Fluxenic Inc. (株式会社Fluxenic), which operates Convika ("we" or "us"), uses cookies and similar technologies to provide site functionality and understand usage patterns. Convika's automated emails, such as the product tips and reminders, contain a small image and links that record when the email is opened and when a link in it is clicked; section 1 of the Privacy Policy (Emails About Your Pages) describes them.

Essential Cookies: Better Auth session cookies (for authentication) and CSRF tokens. These are required for the Service to function. On landing pages served by Convika, `_cvk_consent_essential=1` is set when a visitor answers the cookie banner. After you sign up with an email address and a password, or log in before verifying your address, the API sets `__Host-convika_signup` for 7 days. It holds a keyed hash that tells Convika this browser typed the account's password, so a verification link opened in this browser keeps that password. If your account uses two-step verification, logging in with your password or Google sets `__Host-better-auth.two_factor` while Convika waits for your code, for up to 10 minutes. It holds a signed reference to that log-in, and is deleted once the code is accepted. The dashboard (app.convika.com) also keeps a few records in your browser for signing up and for handing a page over to your account. It sets them whatever you chose in the banner. A claim link carries a claim code, and a promotion code when the person who made the link added one (`?promo=`). The dashboard keeps them in local storage (`claimCode`, `startTrialPromo`) until the page is handed over to your account, so the handover works even when you open the verification link later. The claim code and the promotion code are also added to the link in the verification email, so Convika receives them when you sign up. The claim code is sent again when the page is handed over. When you start a trial and the promotion code is the free code, the dashboard sends it to checkout. Both records are removed once Convika answers, whether the handover worked or not. They stay only when the request failed because of the network, too many requests, or a problem on Convika's servers, and the dashboard tries again the next time you open it. When a page is handed over, the dashboard keeps its ID in local storage (`claimedSiteId`) until you close the welcome note on that page or start your first edit. This record is not sent anywhere. If a claim link had run out or had been used, the dashboard keeps that fact and who made the link in session storage (`claimEnded`) until you close the note about it or close the tab. When you sign up, log in before verifying your address, or open the dashboard signed in with an address you haven't verified yet, the dashboard keeps your email address and the address of the page to return to in session storage (`convika_pending_verification`), so the waiting screen can send the email again. The return address can contain the claim code. The dashboard sends the email address only when you ask for the email again, and the record is removed when you close the tab. If you opened the sign-up page with a referral link, the dashboard keeps the referral code in session storage (`referralCode`) until you are signed in. It then sends the code to Convika to record the referral, and removes it.

Analytics Cookies: On landing pages served by Convika, the cookie banner asks visitors in the European Economic Area, the United Kingdom, Switzerland, Andorra, Monaco, San Marino, Vatican City, Gibraltar, Jersey, Guernsey, the Isle of Man, and France's overseas territories, and visitors whose country can't be told from their connection, whether to allow analytics cookies. `__Host-cvk_consent_analytics` keeps the answer for 1 year: 1 for Allow, 0 for Decline, with a signature. Only the page's own `/_consent` sets it, for the page's host alone, and the page's scripts can't read it (HttpOnly). A choice without a valid signature for that host counts as no choice. With 1, Convika sets `_cvk_vid` (a random visitor ID, 90 days) and `_cvk_sid` (a random session ID, 30 minutes) as soon as the visitor chooses, and again on later visits, whether or not their browser sends Global Privacy Control (GPC). Visitors anywhere else aren't asked: Convika sets the same two cookies when they open a page, unless they chose Decline before, or their browser sends GPC and they haven't chosen Allow. Known bots get neither. On pages of workspaces on a plan without the Convika bar (a paid plan, or a trial of one), Convika shows no cookie banner and sets none of these cookies for any visitor, in any country: no `_cvk_vid`, `_cvk_sid`, or `_cvk_variant`. It deletes them if a browser still has them from before, and counts those pages' visitors without a cookie, as it counts a visitor who chose Decline. It may also set `_cvk_variant`, which records the version of a page a visitor sees in an A/B test until the browser closes; A/B tests aren't in use today. With 0, it deletes these cookies if they were set before.

For a visitor the banner asks who hasn't chosen Allow, a visitor who chose Decline, and a browser that sends GPC without an Allow in the banner, Convika sets no visitor or session cookie and stores nothing in the browser beyond the choice itself. Page views, button clicks, and form submissions are still counted, under a visitor ID computed from the site, IP address, and User-Agent with a key for each day in the time zone the site's workspace uses for analytics (UTC until it uses one), which is deleted 2 days after its day begins. Section 1 of the Privacy Policy explains this ID.

Where analytics events are stored: Each page view, button click, and form submission is its own row, with the page path, referrer, UTM parameters, device type, country, User-Agent, and visitor ID. These rows go to Cloudflare Workers Analytics Engine, which keeps them for 3 months, and to a raw event archive in Cloudflare R2, which keeps them for 400 days. The archive also holds the events for scroll depth, time on page, whether the visitor left right away, how much of each part of the page was on screen and for how long, whether each part was clicked, load speed, and whether they started filling in a form, not what they typed. Button click and form submission events also go to Tinybird, without the User-Agent, and are deleted there after 400 days. None of these rows include the IP address.

Page load signal: Once per load, a published page's script sends the page ID, the path, the URL of the page open before this one, utm_source and utm_medium, and the day the page was served to `/_visit` on the host name that served the page. It sets no cookie and stores nothing in the browser, and it is sent whatever the visitor chose in the banner. Convika writes one row to Cloudflare Workers Analytics Engine, which keeps it for 3 months, with a visitor ID computed without a cookie from the site's host name, the IP address, and the User-Agent with the daily key above. A signal from a browser that has `__Host-cvk_owner` isn't recorded. Section 1 of the Privacy Policy explains it, under Page Load Signal.

convika.com and the dashboard: The banner on convika.com and on the dashboard (app.convika.com) saves your choice in your browser's local storage (`convika_cookie_consent`). If you accept, your browser also keeps a random visitor ID in local storage (`cvk_self_analytics_vid`) until you decline or clear the site's data, and sends it with each page view. On the dashboard's sign-up and log-in pages, accepting also keeps how you got there in local storage (`convika_attr_pending`) until you sign in, for up to 90 days: the UTM parameters, the referring site, and the first page you opened. When a link on convika.com brought you to the sign-up page, it also holds the convika.com page you clicked the link on, unless you declined cookies on convika.com. If you accepted cookies there, it also holds the name of the button you clicked. On convika.com, accepting also keeps the page you entered on, the referring site, and that page's UTM parameters in session storage (`convika_first_touch`) until you close the tab, so a sign-up or log-in link you click on a later page still carries them. If you came from the bar at the bottom of a Free plan page, what it keeps names that bar (the UTM value convika_badge), and as the referring site the address (host name) of the page the bar was on, which the bar's link carries. If you came from a page's line offering to make your own copy, it names that line (convika_copy) the same way. If you decline, or haven't chosen yet, Convika keeps no ID or link in your browser, and deletes any saved earlier without sending them. Your page views still count, under an ID computed from the host name, IP address, and User-Agent with a key for each day in Japan time (JST), which is deleted 2 days after its day begins. Page views go to Convika's database (Cloudflare D1) as daily counts by page, referring site, UTM parameters, device type, and country, and these counts are kept. A page view that came through the bar on a Free plan page counts under the bar, in place of the referring site, and the first page of that visit is also counted with the address (host name) of the page the bar was on. A page view that came through a page's copy line counts under that line. Clicks on convika.com's sign-up and log-in links, uploads from its upload box, its HTML viewer, and its copy page, and pages made on its template pages without an account, are counted too, per day, page, and button. Those counts carry no visitor ID and need nothing stored in your browser, so they don't depend on your choice. The game translation page's translations started, translated games shown, presses of the button that keeps a game, and requests copied are counted the same way, per day. Clicks on the bar at the top of convika.com's pages that links to Convika's own guides and tools are counted the same way, per day, page, and link. The language bar under convika.com's header, which offers the page in your browser's language or in English, is counted the same way, on the first page of a visit that didn't come from convika.com or the dashboard only, per day for each pair of the page's language and the language offered and for what it offered: how many times it was shown and how many times its link was clicked. It reads your browser's language and the page you came from in your browser and stores nothing there, so a bar you closed shows again when you reload the page or open it in another tab. To count unique visitors, the database also keeps rows that pair a one-way hash of each visitor ID with the pages and sources it was counted under that day. Convika deletes these rows 2 days after their day. It stores neither the IP address nor the User-Agent. Apart from these counts, the dashboard's sign-up and log-in screens tell Convika when a sign-up or log-in button is pressed, and send it the errors that occur on the screen. They carry no visitor ID and need nothing stored in your browser, so they are sent whatever you chose (not when your browser asks sites not to track you). Unlike the counts, each report is kept as a record of the request that sent it, with that request's IP address and User-Agent, for 7 days (the Privacy Policy's section 1, under Sign-up and Log-in Screen Events). When the dashboard doesn't open (an error before it opens, leaving the page, or the page going out of view (another tab or app, a minimized window, a locked screen), before it opens, or still not open after 15 seconds), the browser also tells Convika, with the screen it was opening and what went wrong. These reports also carry no visitor ID and need nothing stored in your browser, so they are sent whatever you chose (not when your browser asks sites not to track you). Each is kept with the request's IP address and User-Agent for 7 days (the Privacy Policy's section 1, under When the Dashboard Doesn't Open). The links to AI Skill Pod (another product of Fluxenic, which runs Convika) on convika.com and the dashboard are also counted with no visitor ID, whatever you chose in the banner: for each page view, whether each link was on screen and how many times it was clicked, by where the link is and the page it is on. Nothing is stored in your browser for them.

Functional Cookies: Locale preference (ja/en). The free rebuild tool on convika.com keeps the id and start time of your latest rebuild in local storage (`convika.rebuildTool.lastRun`), so reopening the page shows its result. It is removed when that rebuild ends without a preview, when you start another one, or 7 days after it started. When a rebuild stops because of a problem on Convika's side, the tool also keeps that page's address and the rebuild's id in session storage (`convika.rebuildTool.failedRuns`), so after a second stop in a row it suggests another page instead of the same one. The address is removed when a rebuild of that page ends any other way, and session storage is cleared when you close the tab. The free AI visibility checker on convika.com keeps the id and start time of your latest check in local storage (`convika.aiCheckTool.lastRun`), so reopening the page shows its result. It is removed when the check can't be finished or is no longer found, when you press Check another question or start another check, or, after 7 days, the next time you open the page. When you close a notice on the dashboard with ×, the dashboard keeps that notice's name in local storage (`convika_notice_dismissed:<notice name>`) so the notice doesn't show again in this browser. This record is not sent anywhere, and it is removed when you clear the site's data in your browser. When you close the bar about AI Skill Pod (another product of Fluxenic, which runs Convika) at the top of convika.com with ×, your browser keeps that in local storage (`convika_aiskillpod_bar_closed`: `1`) so the bar doesn't show again in this browser, whatever you chose in the banner. It is not sent anywhere, and it is removed when you clear the site's data in your browser. When you close the bar at the top of convika.com's pages that links to Convika's own guides and tools with ×, your browser keeps that in local storage (`convika_aio_bar_closed`: `1`) so the bar doesn't show again in this browser, whatever you chose in the banner. It is not sent anywhere, and it is removed when you clear the site's data in your browser. The dashboard keeps the language you choose with its language switch, or with a link that names a language, in local storage (`convikaLanguageChoice`: `en` or `ja`), so it opens in that language on your next visit. It sets this record whatever you chose in the banner, and does not store a language it worked out from your browser. An older version of the dashboard stored the language in `convikaLanguage`; the dashboard reads that record once, keeps a Japanese choice from it, and leaves it in place. These two records are not sent anywhere. If you are signed in, the language switch also saves your language to your account. When you are signed in, the dashboard keeps the ID of your selected organization in local storage (`convika_selected_organization_id`), your own organization unless you choose another, whatever you chose in the banner. It sends the ID to Convika with each request, so Convika returns that organization's pages. It is removed whenever you are not signed in, whether you log out or your session expires. To open the site you were on last time, the dashboard keeps the name of the site you last opened in local storage (`convika.lastSite.<organization ID>`), one record per organization, whatever you chose in the banner. It is not sent anywhere, and it stays until you clear the site's data in your browser. When you close the banner that asks you to make or publish your first page, the dashboard keeps a flag in session storage (`convika_activation_banner_dismissed`) so the banner doesn't show again until you close the tab. It sets this flag whatever you chose in the banner. When you skip the welcome screen or choose a way to start, including asking us to make the page for you, the dashboard keeps a flag with your account ID in its name in session storage (`convika_onboarding_dismissed_<account ID>`) so that going back to the dashboard doesn't open the welcome screen again. It sets this flag whatever you chose in the banner. It is removed once you have made your first page, meaning a page with a preview or a published page, and when you close the tab. These two flags are not sent anywhere. When you click a link on the dashboard that opens one of your pages (such as Open page), the dashboard opens the page through that page's own `/_owner` address, which sets `__Host-cvk_owner` (the value 1) for that page's host alone and then shows the page. The cookie lasts 30 days from the last time you open the page this way. Only `/_owner` sets it. While a browser has it, a Free plan page on that host shows, in the Convika bar, a link for the page's creator to remove the bar, which opens the dashboard's comparison of plans. The cookie holds nothing about who you are, the page's scripts can't read it (HttpOnly), and your browser sends it only to that host, where Convika serves the page. For a visitor the page's cookie banner doesn't ask, when a Free plan page uses its analytics cookies for their browser, the links to convika.com in the page's Convika bar also say whether the browser has this cookie, so that a sign-up from the bar records whether the page's creator clicked it (Privacy Policy, section 1, Sign-up Source). Convika records no page load signal from a browser that has it and uses it for nothing else, and opening `/_owner` records no page view.

Pages That Save Data with window.storage or window.claude's db: On a page served by Convika whose script uses window.storage or window.claude's db, the storage that pages made as Claude artifacts use, what the script saves for you alone is kept in your browser's local storage under `cvk-storage:<page ID>:`, whatever you chose in the banner, until the page's script deletes it or you clear the site's data in your browser. It is not sent to Convika. In a preview link, what the page saves for all its visitors is kept in session storage under `cvk-storage-preview-shared:<page ID>:` until you close the tab. What a published page saves for all its visitors is stored by Convika (Privacy Policy, section 1).

Translated Games: A game that Convika translated has a language button. The language a visitor picks with it is kept in the local storage of that game's page (`cvk-lang`), so the game opens in that language the next time. It holds only the language's code, isn't sent to Convika, and stays until the visitor clears the site's data.

Attribution cookie: `convika_attr` (first-party, shared with the dashboard). Only after you accept cookies in the banner on convika.com, it stores the UTM parameters, the referring site, and the first page of your first visit for up to 90 days, so a signup can be traced to the campaign or link that brought it. Declining deletes it.

What Convika's pages send, including what goes without cookies, is listed in What pages on Convika send (https://convika.com/external-transmission/).

Stripe: During the payment flow, Stripe may set cookies for fraud detection purposes.

Cloudflare may set strictly necessary cookies for security and traffic management on Convika-hosted infrastructure.

You can delete or block cookies through your browser settings. Please note that disabling essential cookies may prevent the Service from functioning properly.

On landing pages served by Convika, a banner asks visitors in the European Economic Area, the United Kingdom, Switzerland, Andorra, Monaco, San Marino, Vatican City, Gibraltar, Jersey, Guernsey, the Isle of Man, and France's overseas territories, and visitors whose country can't be told from their connection, whether to allow analytics cookies. Choosing Decline turns off the analytics cookies, not the counting: views, clicks, and submissions are still counted under the daily visitor ID described in section 2. The page load signal is still recorded too. To change your choice, use Cookie settings, the link next to What this page sends. Both are usually at the end of the page. On a page that can't be scrolled to its end, or whose own elements would cover them or sit under them there, they are in a corner of the first screen; on a page shown in a frame, they are in the row under the frame. They are in the page's language if Convika has it, otherwise in the browser's preferred language if Convika has that, and otherwise in English. Cookie settings shows for every visitor the banner asks, and for anyone who answered it before.

Visitors anywhere else aren't asked, and get the analytics cookies unless their browser sends Global Privacy Control (GPC). An Allow chosen before in the banner on the page's site counts over GPC; choose Decline in Cookie settings to change it. To turn the cookies off, turn on GPC in your browser, or block cookies for the page's site. Convika takes the country from Cloudflare, which tells it from the IP address, and records only the country, as it does for every page view. Pages of workspaces on a plan without the Convika bar (a paid plan, or a trial of one) have neither the banner nor Cookie settings, since Convika sets no analytics cookie on them.

On convika.com and the dashboard, the banner asks whether you accept cookies. Declining deletes the stored visitor ID and the `convika_attr` cookie, and on the dashboard `convika_attr_pending` too, but page views are still counted under the daily ID described in section 2, and clicks on sign-up and log-in links and uploads from the upload box, the HTML viewer, and the copy page are still counted with no ID. To change your choice, use Cookie settings at the bottom of any page on convika.com, or the Cookies section in the dashboard's Account settings.