Cookie policy

Last updated: October 10, 2026 · Effective

This page lists the cookies that the Paycux website at paycux.com and the Paycux console set in your browser, what each one is for, how long it lasts and how to remove it. It describes what the software does today, not what it might do; when the set of cookies changes, this page changes with it.

What we do not use

Paycux sets no analytics cookies, no advertising or marketing cookies and no cookies for social media or embedded support widgets. There is no cookie banner because there is nothing optional to consent to: every Paycux cookie listed below is strictly necessary to sign you in and to keep that sign-in secure.

Browsing the public pages (home, pricing, documentation, blog, status and legal pages) sets no Paycux cookie at all. Our network provider, Cloudflare, may set its own strictly necessary security cookie (such as __cf_bm or cf_clearance) when it needs to distinguish browsers from automated traffic; those cookies are not used for analytics or advertising and are described in Cloudflare's cookie documentation.

Strictly necessary cookies set by Paycux

All of the following cookies are set with the attributes HttpOnly, Secure, SameSite=Lax, Path=/. The __Host- prefix means a browser only accepts them from paycux.com over HTTPS and never sends them to another host or a parent domain. HttpOnly means page scripts cannot read them.

Cookie	Purpose	Lifetime
`__Host-paycux_session`	Keeps you signed in to the Paycux console after the identity service has verified you. It holds an opaque session token, never your email address or password.	Up to 12 hours from sign-in. The server also ends the session after 30 minutes without activity, and the cookie is removed when you sign out.
`__Host-paycux_oauth_state`	Protects the sign-in redirect against forgery by tying the response to the request your browser started.	10 minutes, removed as soon as sign-in completes or fails.
`__Host-paycux_oauth_nonce`	Binds the identity token returned by the identity service to this browser's sign-in attempt.	10 minutes, removed as soon as sign-in completes or fails.
`__Host-paycux_oauth_verifier`	Holds the one-time PKCE verifier needed to finish the authorization code exchange.	10 minutes, removed as soon as sign-in completes or fails.
`__Host-paycux_oauth_invite`	Carries a workspace invitation through sign-in so it can be accepted by the verified account. Set only when you open an invitation link.	10 minutes, removed as soon as sign-in completes or fails.

Sign-in through the Paycux identity service

When you sign in or register, your browser is redirected to auth.paycux.com, the identity service that Paycux operates. It sets its own strictly necessary cookies (names beginning with AUTH_SESSION_ID, KEYCLOAK_ and KC_) to complete the sign-in and to remember that you have signed in there. They are set on auth.paycux.com, not on paycux.com, and are cleared when you sign out or when that identity session expires.

Third-party cookies

Paddle Checkout is the merchant of record for Paycux subscriptions. Paddle's script loads on the checkout pages and on the console's billing page, and the checkout itself runs inside a frame served by Paddle. Cookies set inside that frame belong to Paddle and are governed by Paddle's privacy policy.

Cloudflare performance measurement

Cloudflare also adds a Web Analytics script to the production website to measure page views and page-load performance. This script is separate from Cloudflare's security cookies and from Paddle Checkout. See Cloudflare's data collection documentation for the information collected by its performance beacon.

How to clear or block cookies

You can inspect, delete and block cookies in your browser settings. Because every Paycux cookie is strictly necessary, blocking them has a direct effect:

Signing out removes the session cookie and any remaining sign-in cookies immediately.
Blocking cookies for paycux.com prevents you from staying signed in to the console; the public pages keep working.
Blocking cookies for auth.paycux.com prevents the identity service from completing sign-in.
Blocking cookies inside the Paddle checkout frame may stop a checkout from completing.

Changes and questions

This page is updated in the same change as the code that sets a cookie, so the inventory above matches the running software. Questions can be sent to privacy@paycux.com. See the privacy policy for how the data behind a signed-in session is handled more broadly.