Linktain: lock a link, get paid when people open it

1Three cookies, and none of them follow you

Linktain sets no advertising cookies, no analytics cookies and no trackers. There is no Google Analytics, no Facebook pixel and no tag manager anywhere on this site. The three below are what makes the product work at all.

2lt_session, when you have an account

Set when you log in. It holds a signed token naming your account id and your role, and nothing else. HttpOnly and Secure, so scripts cannot read it and it never travels unencrypted. Delete it and you are logged out.

3lt_pass, when you buy a pass

Set after payment. It holds one random secret that maps to the pass you bought; the pass itself lives on our side and this cookie is only the ticket. Clearing it costs you the pass on that browser, which is why the receipt explains how to get it back.

4lt_oauth_state, for a few seconds during Google sign-in

Set when you press Continue with Google, deleted the moment you come back. It holds a random value we check on return, which is what stops somebody handing you a link that logs you into their account instead of yours.

5What we keep instead of a cookie

When a visitor clears a gate, we do not mark their browser. We store a salted one-way hash of their IP address against that link, so the same visitor is not paid twice within 24 hours and does not have to redo a gate they already finished. The original address is not stored and the hash cannot be reversed to recover it.

6Cookies the sponsored steps set

Opening a sponsored step sends you to a partner's own site, and whatever that site sets is covered by its policy rather than ours. We pass a click identifier so a completed offer gets credited to the right creator. We do not read any cookie a partner sets, and we could not if we wanted to.

7Turning them off

Every browser can block or clear cookies. Blocking these three breaks nothing permanently: you log in again, you redo a gate you had already cleared, and you lose a pass on that one device.