Cookie Policy

1. Introduction

This Cookie Policy explains what cookies SourceStream uses, why we use them, and how you can control them. It covers two contexts:

1. The SourceStream platform (sourcestream.io) -- cookies used when you log in to your dashboard and use our service.
2. Customer websites -- the cookie set by the SourceStream tracking script on websites that use our marketing attribution service.

This policy should be read alongside our Privacy Policy, which provides further details about how we handle personal data.

2. What Are Cookies

Cookies are small text files stored on your device when you visit a website. They allow the website to recognize your device and remember information about your visit, such as your preferences or login status.

Cookies can be:

• First-party cookies: Set by the website you are visiting. They can only be read by that website.
• Third-party cookies: Set by a domain other than the one you are visiting.
• Session cookies: Temporary cookies that are deleted when you close your browser.
• Persistent cookies: Cookies that remain on your device for a set period or until you delete them.

3. Cookies on the SourceStream Platform

When you visit sourcestream.io and use our dashboard, we use the following cookies. All of these are strictly necessary for the platform to function and are first-party cookies set on the sourcestream.io domain.

Cookie Name	Type	Duration	Purpose
laravel_session	First-party, session	2 hours (or until browser close)	Maintains your authenticated session so you stay logged in as you navigate the dashboard.
XSRF-TOKEN	First-party, session	2 hours	Protects against cross-site request forgery (CSRF) attacks by verifying that form submissions and API requests originate from our site.
sourcestream_session	First-party, session	2 hours (or until browser close)	An encrypted session identifier used by the Laravel framework to manage your session state.

We do not use any advertising, retargeting, third-party analytics, social media tracking, or other non-essential cookies on sourcestream.io.

4. Cookies Set by the Tracking Script

When a SourceStream customer installs our tracking script on their website, the script sets one cookie on the customer's domain:

Cookie Name	Type	Duration	Purpose
_ss_uid	First-party, persistent	365 days	Assigns a randomly generated unique identifier to the visitor. This ID is used to connect multiple visits by the same person on the same website, enabling the website owner to see which marketing channels brought the visitor over time.

Key facts about the _ss_uid cookie:

• First-party only: This cookie is set on the customer's domain (e.g., example.com), not on sourcestream.io. It can only be read by the website that set it.
• No cross-site tracking: The cookie does not track you across different websites. Each website has its own separate cookie with a unique ID.
• Randomly generated ID: The cookie contains a random identifier (e.g., ss_a1b2c3d4e5f6). It does not contain your name, email, IP address, or any other personally identifiable information.
• Attribution purpose only: The cookie exists solely to connect your visits to marketing sources (e.g., "this visitor first came from a Google ad, then returned via organic search"). It is not used for advertising, profiling, or selling data.
• 365-day duration: The cookie lasts one year to capture the full customer journey, as visitors often return to a website multiple times over weeks or months before converting. The customer (website owner) may configure a shorter duration if required by their privacy policies.

What data does the tracking script collect?

In addition to the cookie, the tracking script captures the following data and sends it to SourceStream's servers:

• The page URL you are visiting
• The referring URL (the page that linked you to this site)
• UTM parameters from the URL (utm_source, utm_medium, utm_campaign, utm_term, utm_content)
• Ad click identifiers (gclid, fbclid, msclkid, etc.)
• Your browser type and operating system
• Timestamps of your visits

This data is stored and made available to the website owner through their SourceStream dashboard. It is not used by SourceStream for our own purposes, not sold, and not shared with any third party other than the website owner.

5. Managing and Disabling Cookies

5.1 Platform Cookies (sourcestream.io)

The cookies on our platform are essential for it to function. If you disable them, you will not be able to log in or use the SourceStream dashboard. You can manage these cookies through your browser settings.

5.2 Tracking Script Cookie (_ss_uid)

If you are a visitor to a website that uses SourceStream and want to opt out of the tracking cookie, you have several options:

• Browser settings: Configure your browser to block cookies from the website you are visiting, or block all cookies. Note that this may affect the functionality of the website.
• Delete the cookie: You can delete the _ss_uid cookie through your browser's cookie management interface. A new cookie will be set on your next visit unless you also block cookies.
• Website's cookie consent: If the website provides a cookie consent banner or preference center, use it to opt out of analytics or tracking cookies. When properly implemented, this will prevent the SourceStream script from setting a cookie.
• Private/incognito browsing: Cookies set during a private browsing session are deleted when you close the window.

5.3 Browser-Specific Instructions

To manage cookies in your browser:

• Chrome: Settings > Privacy and Security > Cookies and other site data
• Firefox: Settings > Privacy & Security > Cookies and Site Data
• Safari: Preferences > Privacy > Manage Website Data
• Edge: Settings > Cookies and site permissions > Cookies and site data

6. Cookie Consent

For SourceStream Platform Users

All cookies on sourcestream.io are strictly necessary for the service to function. Strictly necessary cookies are generally exempt from consent requirements under most cookie laws.

For Website Visitors (Tracking Script)

Whether consent is required for the _ss_uid cookie depends on the laws that apply to the website you are visiting. Website owners who use SourceStream are responsible for complying with local cookie and privacy laws in their jurisdiction, including implementing any required consent mechanisms before loading the tracking script.

SourceStream provides guidance and documentation to help customers implement appropriate consent mechanisms. The responsibility for obtaining consent lies with the website owner (our Customer), who acts as the data controller.

7. Changes to This Policy

We may update this Cookie Policy from time to time. When we make changes, we will update the "Last updated" date at the top of this page. For material changes, we will notify SourceStream account holders by email.

8. Contact Us

If you have questions about this Cookie Policy, contact us at:

• Email: [email protected]
• Website: sourcestream.io

If you are a visitor to a website that uses SourceStream and have questions about how that website uses your data, please contact the website owner directly.