Cookie policy
Updated September 4, 2026
Four cookies. Three keep the product working. The fourth gives a survey partner a name for your browser.
2lt_session, when you have an account
Set when you log in. It holds a signed token naming your account id and your role, and nothing else. HttpOnly and Secure, so scripts cannot read it and it never travels unencrypted. Delete it and you are logged out.
3lt_pass, when you buy a pass
Set after payment. It holds one random secret that maps to the pass you bought; the pass itself lives on our side and this cookie is only the ticket. Clearing it costs you the pass on that browser, which is why the receipt explains how to get it back.
4lt_oauth_state, for a few seconds during Google sign-in
Set when you press Continue with Google, deleted the moment you come back. It holds a random value we check on return, which is what stops somebody handing you a link that logs you into their account instead of yours.
5lt_sid, so a survey partner has a name for your browser
Set only when you press the button on a survey step, and only if it is not already there. Opening any other kind of sponsored step does not set it. It holds 128 random bits and nothing about you, it is HttpOnly and Secure so scripts cannot read it, and it is a session cookie: closing your browser ends it. The value itself never leaves our server. What the survey company gets is a hash of that value plus a secret we hold, cut short, so they see a name for your browser and cannot work back to the cookie. That still means a market research company can tell you are the same browser it saw earlier in your session. Their link is refused when we send no id, which is the only reason this cookie exists. We use it for nothing else: no analytics, no profile on our side, and no other company receives it.
6What we keep on our side
When a visitor clears a gate, we store a salted one-way hash of their IP address against that link, so the same visitor is not paid twice within 24 hours and does not have to redo a gate they already finished. The original address is not stored and the hash cannot be reversed to recover it.
8Turning them off
Every browser can block or clear cookies. Blocking lt_session, lt_pass and lt_oauth_state breaks nothing permanently: you log in again, you redo a gate you had already cleared, and you lose a pass on that one device. Blocking lt_sid is different, because a survey step cannot run at all without it. Every other way through a gate still works.