What we use
Cookies, local storage, and a small amount of first-party analytics.
A cookie is a small file a site stores on your device. We also use local storage and session storage, which work similarly. This policy covers all of them, plus mobile SDK identifiers.
Kwirl does not run advertising networks, does not embed third-party ad pixels, and does not share your browsing with data brokers.
The categories we set
Strictly necessary always on. Everything else is a choice.
- Strictly necessary: session token, CSRF token, load balancing, and your cookie choice itself. These cannot be switched off, and under the Privacy Act and the equivalent New Zealand and United States rules they do not require consent.
- Preferences: saved filters and last workspace. Off means the product forgets your settings between visits.
- Analytics: first-party, aggregated, IP truncated before storage. Tells us which features get used and where people drop out of a flow.
- Performance: error and crash reporting so we can fix what breaks.
Named cookies
The short list.
- kw_session — strictly necessary — session — keeps you signed in.
- kw_csrf — strictly necessary — session — protects form submissions.
- kwirl_cookie_consent — strictly necessary — 12 months — remembers your cookie choices.
- kw_prefs — preferences — 12 months — saved filters and workspace.
- kw_announcement_dismissed — preferences — until cleared — remembers that you closed the announcement bar. Only stored if you accept preference storage.
- kw_analytics_id — analytics — 13 months — a rotating first-party identifier, not linked to your profile.
- kw_perf — performance — 30 days — sampling key for crash reporting.
Your controls
Change your mind whenever, from the footer.
The consent banner appears on first visit and your choices are stored for 12 months. Cookie settings in the footer reopens it at any time.
You can also block or clear cookies in your browser. Blocking the strictly necessary ones will sign you out and break parts of the product.
We honour Global Privacy Control signals as an opt-out of analytics and any sharing, which satisfies the United States state opt-out requirements.
Do Not Track and mobile
Honoured on both.
We treat a Do Not Track header the same way as declining analytics.
In the mobile apps we ask through the operating system prompt on iOS, and we do not use the advertising identifier on either platform.
Questions about this policy
Write to legal@kwirl.com.au for anything on this page, privacy@kwirl.com.au for a privacy request, or security@kwirl.com.au to report a vulnerability. Postal mail reaches us at Kwirl Australia Pty Ltd, Australia.