Cookie policy
Last updated 12 October 2026.
On tracelead.io and the dashboard
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
tracelead_session | Keeps you logged in and protects forms against cross-site request forgery. | Strictly necessary | Session (2 hours idle) |
XSRF-TOKEN | Cross-site request forgery protection for the dashboard. | Strictly necessary | Session |
remember_web_* | "Remember me" login. | Strictly necessary (opt-in) | Up to 5 years |
sidebar_state, appearance | Remembers your layout and light/dark preference. | Functional | 1 year |
The marketing pages count page views without cookies or identifiers (path, referrer host and campaign parameters only, aggregated per day). We do not currently run the TraceLead snippet on tracelead.io itself.
Set by the TraceLead snippet on customers' websites
These are first-party storage items on the customer's domain. In the default explicit consent mode nothing below is created until the customer's consent mechanism signals consent; withdrawing consent deletes them.
| Name | Purpose | Lifetime |
|---|---|---|
tl_ft_<site id> | First-touch attribution (campaign parameters, referrer host, landing path, time). Cookie, or local storage if cookies are blocked. | Configured per site, 90 days by default |
tl_vid_<site id> | Random visitor identifier used to group sessions. Contains no personal information. | Same as the first touch |
tl_lt_<site id> | Most recent campaign visit (same contents as the first touch). Only set on sites that have turned on the last-touch option. | Same as the first touch |
tl_ec_<site id> | A count of visits and the time of the last one. Only set on sites that have turned on engagement counters. | Same as the first touch |
tl_sid_<site id> | Random session identifier (sessionStorage). | Browser tab, 30 minutes idle |
Sites that turn on contact clicks (counting clicks on phone, email, SMS and WhatsApp links) use the identifiers above and set nothing extra.
The snippet never sets third-party cookies and never fingerprints devices. It reads one cookie set by another service, and only when the site owner maps the field: Google Analytics' _ga, whose client identifier it copies into the site owner's form. That value is not sent to TraceLead.