Cookie policy
The cookies and browser storage coritan.com uses, what each one is for, and how long it lasts.
The cookies and browser storage coritan.com uses, and what each one is for.
Last updated 19 October 2026
A cookie is a small file a website asks your browser to keep and send back on later visits. coritan.com sets the cookies below and keeps a few values in your browser’s storage. The cookies under Cookies we set are always on. Analytics and advertising cookies are set only if you accept them.
Cookies we set
_ct_sid- We use it to count visits. It holds a random identifier that groups the pages you open in one visit, so we can see which pages people use. When you sign up or sign in, we link the visit to your account. It lasts 30 minutes.
_ct_vid- It holds a random number that recognises a returning browser, so we can tell a new visitor from a returning one. It lasts one year.
_ct_attr- It records the link or search that brought you here, with any ad click ID, so we can tell which channel a sign up or an order came from. Only our servers can read it. It lasts 90 days.
_ct_consent- It remembers what you chose in the cookie banner. It lasts six months.
wm_session- It keeps you signed in to the mailboxes you open in webmail with a mailbox password. Only webmail’s requests carry it, and scripts on the page cannot read it. It lasts up to 30 days, or until you sign out.
__Host-coritan_waf- Our firewall sets it only when it asks your browser to pass a check before letting a request through. It shows that this browser passed, so the check does not repeat on every page. It lasts 20 minutes.
What we keep in your browser
Your browser’s local storage keeps these on your device between visits:
- The tokens that keep you signed in to the dashboard and to webmail. Signing out removes them.
- The features your account has, so the dashboard shows the right menus as soon as it opens.
- Choices you make, such as a notice you closed, your recent searches in webmail and whether this browser shows new mail notifications.
Wicket, our own check that a person is filling in a form, sets no cookie and keeps nothing in your browser. Its script loads from wicket.coritan.com only on pages with such a form, such as sign in, sign up, the contact page and the Under attack page.
Session storage keeps values for one tab and clears them when you close it. It holds a referral code from a link you followed until you finish signing up, and the details of a payment while you complete it on the payment processor’s page.
Analytics and advertising
When we turn them on, Google Analytics, Google Ads, Meta, TikTok, Microsoft Advertising, Reddit and X measure visits and ads on the public site. They never run in the dashboard. Analytics cookies (_ga and _ga_*, up to two years) and advertising cookies (_gcl_*, _fbp, _fbc, _ttp, _uetsid, _uetvid and _rdt_uuid, from one day to 13 months) are set only if you accept them. Until you accept analytics cookies, Google receives page views with no cookie and no identifier.
After an order or a sign up, our servers send it to the advertising platforms we use, with your email address hashed, only if you accepted advertising cookies when you did it. If you did not, only Google Analytics and Google Ads receive a count, with no personal data.
Services from other companies
If our own check, Wicket, is not available, a form uses Cloudflare Turnstile in its place. It checks that a person is filling in the form. Its script then loads only on pages with such a form, such as sign in, sign up, the contact page and the Under attack page.
Stripe and PayPal process card and PayPal payments. Their scripts load only when you pay or add a payment method in the dashboard, and they can set cookies of their own to process the payment and to spot fraud. Each company’s own cookie policy describes them.
Square also takes card payments in US dollars. Its card form loads from Square only when you open the card step of a payment in the dashboard.
Your choices
Where the law asks for it, as in the European Economic Area, the United Kingdom and Switzerland, we set no analytics or advertising cookies until you accept them. Elsewhere they are on until you opt out. Change your choice at any time with Cookie settings in the footer. If your browser sends Global Privacy Control, we never turn advertising cookies on, whatever you choose.
You can delete the cookies and site data coritan.com keeps in your browser’s settings at any time. Doing so signs you out of the dashboard and webmail. Send questions about this policy to privacy@coritan.com.
