Cookie Policy

A cookie is a small text file that a website stores in your browser and that the browser sends back with later requests. Local storage and session storage are similar browser features that let a page keep small pieces of information on your device; unlike cookies, they are not sent to the server automatically.

The law treats all of these the same way: storing information on, or reading it from, your device generally needs your consent, unless it is strictly necessary to provide a service you have explicitly asked for (Article 5(3) of the EU ePrivacy Directive 2002/58/EC, as implemented in national law).

This is the complete list. Every item is first-party (set by exitomail.com), is used only to provide the Service you asked for, and is never used to track you across other websites.

Sign-in cookies are set only when you sign in. The transfer cookie is set only when you unlock a password-protected transfer. Visitors who only read our public pages get none of these cookies.

Security cookies at the network edge

Our website and web app are delivered through Cloudflare's network, which protects them against attacks and abuse (mail delivery and mail apps don't pass through Cloudflare). Depending on the protections we switch on, Cloudflare may set strictly necessary security cookies on exitomail.com, such as __cf_bm (bot management; expires after 30 minutes of inactivity) or cf_clearance (proof that a security challenge was passed). These cookies are not used for analytics or advertising, and are covered by the same exemption. See Cloudflare's cookie documentation (s’ouvre dans un nouvel onglet) for details.

Bot checks on forms (if we switch them on)

We protect sign-up, password reset, transfer and report forms, and sign-in after several failed attempts, with Cloudflare Turnstile, a bot check that usually runs without asking you to do anything. To work, it reads signals from your browser and connection (your IP address, TLS fingerprint and user agent) and gives the form a one-time token. The way we use it, it does not set a cookie. Cloudflare says it uses these signals only to detect bots, not to identify, profile or target anyone; see the Turnstile privacy addendum (s’ouvre dans un nouvel onglet). Because the check is strictly necessary to protect the form you are using, it does not need consent. If that changes, we will list any cookie it sets here.

• No analytics. We don't run Google Analytics or any other analytics tool, cookie-based or cookieless. We keep only plain totals, with no cookie or identifier: page loads per country, visits and sign-ups that came through links in our own social media posts and ads, per network, and new subscriptions per billing country and plan. The Privacy Policy explains all three.
• No advertising. There are no ads in ExitoMail, ever, and no advertising or retargeting pixels.
• No social plugins. No “like” buttons or embedded social widgets that track you.
• No cross-site tracking. We don't identify or follow you across other websites. Bot checks, where we use them, look at browser signals only to tell people from bots.
• No tracking added to mail. We never add tracking pixels or tracked links to the messages you send or receive. Download receipts for Exito Transfer come from the download itself, not from tracking.

Consent banners exist to ask permission for cookies that are not strictly necessary, such as analytics or advertising. Because everything listed above is strictly necessary to provide the Service you requested (signing in, keeping your session secure, remembering a display preference you set), the law does not require consent for it, and asking would only add friction without giving you a real choice.

When you buy a plan, you complete the purchase on Link's checkout page: our paid plans are sold through Link, Stripe's checkout. That page, the Link website and Stripe's customer portal are operated by Stripe under its own terms, and Stripe may use cookies there to process the payment, prevent fraud and, if you choose to save your details with Link, recognise your device for faster checkout. See the Stripe cookie policy (s’ouvre dans un nouvel onglet) and the Link Privacy Policy (s’ouvre dans un nouvel onglet). The same applies to any external website you open from a link in an email.

You can view, block and delete cookies and site data in your browser settings. If you block the strictly necessary items above, you will not be able to sign in or use the app, but public pages and Exito Transfer download pages will keep working (password-protected transfers need the transfer cookie). The theme and layout preferences can be cleared at any time by clearing this site's data in your browser.

Helpful guides: Chrome (s’ouvre dans un nouvel onglet), Firefox (s’ouvre dans un nouvel onglet), Safari (s’ouvre dans un nouvel onglet), Edge (s’ouvre dans un nouvel onglet).

We will update this policy whenever what we store changes, and show the new date at the top. Questions about cookies or privacy: write to privacy@exitomail.com.