Cookie Policy
Last updated 26 September 20261. What are cookies?
Cookies are small text files stored on your device when you visit a website. They let a site remember your actions and preferences (such as staying signed in) over a period of time. We also use closely-related technologies such as your browser’s session storage.
2. How we use cookies
BrokLeads does not use advertising or cross-site tracking cookies. We rely mainly on strictly-necessary cookies needed to run the Service securely, plus Google Analytics cookies. If you are in the EEA, the UK or Switzerland they stay off unless you accept them; elsewhere they are on by default and you can switch them off at any time.
3. Cookies we set
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
| auth_token | Keeps you securely signed in to your account. Stored as an httpOnly cookie so it is not readable by scripts. | Strictly necessary | Session |
| branch_id | Remembers which branch/business workspace you are currently working in. | Strictly necessary | Session |
| demo_session | Used only for guided/demo sessions to distinguish them from real accounts. | Functional | Session |
| _ga, _ga_* | Google Analytics: tells us, in aggregate, which pages are visited and how people move through the site. In the EEA, UK and Switzerland, set only if you accept; elsewhere on by default, and you can switch them off. | Analytics (optional) | Up to 2 years |
The first three are session cookies: they are httpOnly, and they are cleared when you sign out or close your browser. For visitors in the EEA, the UK and Switzerland the Google Analytics cookies are set only after you choose “Accept” in the cookie notice; until then Google Analytics gets no cookies. Elsewhere we don’t show a notice and measurement is on until you turn it off with the link below. Inside the CRM we send only the page path (never search terms, filters or links containing tokens) and never your leads, clients or messages. You can change your choice at any time: .
Our own forms on brokleads.com don’t use a third-party challenge; they use a hidden field to catch bots. The lead form that businesses add to their own websites can use Cloudflare Turnstile, which may set short-lived cookies on the business’s site to tell people from bots.
When you connect TikTok in the web app, we keep a random security code in your browser’s session storage until the connection finishes. The mobile app keeps your sign-in token in your device’s secure storage, not in cookies.
To decide whether to show the analytics notice, your browser’s session storage also keeps a yes/no flag for as long as the tab is open: whether your country (read from your request, not stored by us) is one where we must ask first.
4. Third-party cookies
On the sign-in page and in Settings → Integrations, we load Meta’s JavaScript SDK so you can use “Continue with Facebook” or connect Facebook, Instagram or WhatsApp. We start it with its own cookie option switched off, but Meta may read or set cookies on its own domains under Meta’s Cookie Policy. We don’t load it on brokleads.com’s marketing pages, and we use no advertising cookies. Google Analytics (see section 3) loads Google’s script from googletagmanager.com, and Google may process the technical data it receives under its own privacy policy. If a business adds our form to its website, that site’s own cookies are governed by its policy. We do not control third-party cookies.
5. Managing cookies
You can control or delete cookies through your browser settings. Because our core cookies are strictly necessary, blocking them will prevent you from signing in and using the Service. Most browsers let you refuse or remove cookies and notify you when one is set — see your browser’s help pages for details.
6. Changes
We may update this Cookie Policy as our use of cookies evolves. Changes are posted here with a new “Last updated” date.
7. Contact
Questions about cookies? Email support@brokleads.com.