Legal
Cookie Policy
Effective 6 November 2026 · Operated by endframe.io
The cookies and similar storage EndFrame uses on its own sites, what the EndFrame snippet stores on customer websites, and how to change your choices.
Your choices
When you first visit www.endframe.io we ask whether we may use analytics and marketing cookies. No analytics or advertising tool loads until you choose, and rejecting is as easy as accepting. One record is kept whatever you choose; see Sign-up links. If your browser sends a Global Privacy Control signal we keep marketing cookies off. You can change or withdraw your choice at any time. Withdrawing removes the analytics and advertising cookies we can reach, plus the click IDs and hashed identifiers EndFrame's snippet keeps in your browser's local storage (ef_clk and ef_id), removes the click IDs kept for sign-up links (ef_click_ids), and reloads the page. It does not change what is already saved with an account; see our Privacy Policy.
Strictly necessary
These are needed for the sites to work and do not require consent.
| Name | Where | Purpose | Duration |
|---|---|---|---|
| ef_consent | www.endframe.io (cookie scoped to .endframe.io) | Remembers your cookie choices so we only load optional tags you allowed. | 180 days |
| endframe_token | app.endframe.io (HTTP-only cookie) | Keeps you signed in to the EndFrame dashboard. | 7 days |
| theme | app.endframe.io (localStorage) | Remembers your light or dark theme preference. | Until you clear it |
| endframe.utm-builder.presets | www.endframe.io (localStorage) | Saves UTM Builder presets you create, on your device only. | Until you clear it |
Analytics (with consent)
When you allow Analytics we load Google Tag Manager, which loads Google Analytics, Microsoft Clarity (heatmaps and session recordings, with text you type masked), Ahrefs Web Analytics and EndFrame's own tracking snippet. We do not run advertising tags on this site today. If we add any, they will load only with your Marketing consent. Our snippet keeps ad click IDs from the page address (ef_clk) only when you also allow Marketing, and never when your browser sends Global Privacy Control, and without Marketing we remove them from the addresses the snippet sends before storing them. Tools that run in your browser, such as Google Analytics and Clarity, see the full page address, which can include a click ID from an ad link. You can change your choice at any time from the Cookie settings link in the footer.
| Name | Where | Purpose | Duration |
|---|---|---|---|
| _ga, _ga_* | www.endframe.io (only with Analytics consent) | Google Analytics 4 cookies that count visits and measure how the site is used. | Up to 2 years |
| _clck, _clsk | www.endframe.io (only with Analytics consent) | Microsoft Clarity cookies that group page views into a session for heatmaps and session recordings (clicks, scrolling and page changes, with text input masked). | _clck up to 1 year, _clsk 1 day |
| MUID, CLID, ANONCHK, SM, MR | clarity.ms and bing.com (third-party, only with Analytics consent) | Microsoft cookies set by Clarity to recognise the browser across Clarity sessions. | Up to 1 year |
| ef_visit_*, ef_vid | www.endframe.io (only with Analytics consent) | EndFrame's own tracking snippet, used to measure our site the same way our customers measure theirs. | Session and 1 year |
| ef_clk | www.endframe.io (localStorage, cookie fallback; only with Analytics and Marketing consent) | Ad click IDs from the landing URL (for example gclid or fbclid), kept by EndFrame's own snippet so a later sign-up can be credited to the ad that brought you. | 90 days |
| Ahrefs Web Analytics | www.endframe.io (only with Analytics consent) | Counts page views and referrers. It sets no cookies. | No cookie |
Sign-up links
To know which campaign brought a new account, this site keeps a small record for the current tab in your browser's session storage and adds it to sign-up links when you click one. It holds the campaign labels from the link you followed, the landing page path and the outside site that sent you, and is kept whatever you choose in the cookie banner. We leave out values shaped like an email address. Ad click IDs are kept only with your Marketing consent, and never when your browser sends Global Privacy Control. If you sign up, these values are saved with your account; see our Privacy Policy.
| Name | Where | Purpose | Duration |
|---|---|---|---|
| ef_first_touch | www.endframe.io (sessionStorage) | The campaign labels (UTM tags) on the first page you opened, that page's path, and the hostname of the outside site that sent you. Click IDs and values shaped like an email address are left out. It is added to sign-up links so we know which campaign brought a new account. | Until you close the tab |
| ef_click_ids | www.endframe.io (sessionStorage; only with Marketing consent, never with Global Privacy Control) | Ad click IDs from the landing URL (gclid, gbraid, wbraid or fbclid), added to sign-up links so a new account can be credited to the ad that brought it. | Until you close the tab, or withdraw Marketing consent |
Cookieless measurement
We use Vercel Web Analytics and Speed Insights to count page views and measure page performance. They do not set cookies or store identifiers on your device.
EndFrame on customer websites
Businesses that use EndFrame add our snippet (t.js) to their own websites. The storage below is set on those websites by the business that runs them, which decides whether to ask visitors for consent and passes that choice to the snippet. Questions about it should go to that business; see our Privacy Policy for our role as their processor.
| Name | Where | Purpose | Duration |
|---|---|---|---|
| ef_visit_<domain id> | Customer sites running t.js (first-party cookie) | Groups page views into one visit. | Session |
| ef_vid | Customer sites running t.js (first-party cookie) | A random visitor ID so returning visits can be counted. Set only when the site allows analytics. | 1 year |
| ef_clk | Customer sites running t.js (localStorage, cookie fallback) | Ad click IDs from the landing URL (for example gclid or fbclid) so later conversions can be credited. Set only when the site allows ads measurement. | 90 days |
| ef_id | Customer sites running t.js (localStorage, cookie fallback) | SHA-256 hashes of an email or phone number the site passes to identify(). Raw values are never stored. Set only when the site allows ads measurement. | 1 year |
Browser controls
You can also block or delete cookies in your browser settings. Blocking strictly necessary cookies may stop parts of the sites, such as signing in to the dashboard, from working.
Contact
endframe.io
privacy@endframe.io