Cookies
Last updated: 8 November 2026
The German version of this text is the legally binding one.
The short version
On getlooky.ai we split what we store on your device into two groups.
- Necessary: your language, light or dark mode, your cookie choice and the bot check on our forms. This is always on and needs no consent.
- Statistics: Google Analytics 4, which tells us which pages are visited and how visitors find us. This is off until you accept it in the cookie banner. Before that, your browser does not contact Google at all: no script is loaded, no request is sent and no Google cookie is set.
You can accept, reject or change your choice at any time with “Cookie settings” in the footer or on the cookie settings page. Rejecting is as easy as accepting. If you withdraw your consent, we stop Google Analytics and delete its cookies in your browser.
Only on the website. Statistics, the cookie banner and your choice exist only on the marketing website getlooky.ai. The Looky app (app.getlooky.ai) and its admin area are separate applications: they load no analytics, advertising or marketing tools and set no tracking cookies, and a choice you make here does not carry over into the app.
Legal bases
- Statistics (Google Analytics): your consent under Art. 6 (1) (a) GDPR and § 25 (1) TDDDG (German Telecommunications Digital Services Data Protection Act). Storing the Google cookies on your device and reading them afterwards both need your consent. You can withdraw it at any time with effect for the future (Art. 7 (3) GDPR); what we did before the withdrawal stays lawful.
- Necessary entries: § 25 (2) no. 2 TDDDG, because they are strictly necessary for us to provide the website function you asked for (for example showing the page in your language, remembering dark mode, keeping you signed in). The data processing that goes with them rests on Art. 6 (1) (f) GDPR, our interest in a working website. No consent is needed.
- The consent cookie and the bot check: the cookie
looky-consentexists to prove and honour your choice (Art. 6 (1) (c) GDPR together with Art. 7 (1) GDPR, and § 25 (2) no. 2 TDDDG). The bot check protects our forms against abuse (Art. 6 (1) (f) GDPR, § 25 (2) no. 2 TDDDG).
Website getlooky.ai
Necessary entries:
| Name | Type | Purpose | Provider | Duration | Category |
|---|---|---|---|---|---|
looky-consent | Cookie | Stores your cookie choice (statistics yes or no) and the date of your decision, so the banner does not ask again on every page. Set when you decide. No identifier, no IP address. | getlooky.ai (first party) | 12 months | Strictly necessary (legal duty to document and honour your choice) |
looky-locale | Cookie | Stores your language choice. Only set when you pick a language in the language switcher yourself. | getlooky.ai (first party) | 1 year | Strictly necessary (preference) |
looky-theme | Local storage | Remembers whether you chose light or dark mode. Not set while you use the system setting. | getlooky.ai (first party) | Until you clear the site data | Strictly necessary (preference) |
looky:banner:<id> | Local storage | Remembers that you closed an announcement banner, so it does not come back. | getlooky.ai (first party) | Until you clear the site data | Strictly necessary (preference) |
looky-checklist:<guide>:<language> | Local storage | Remembers which steps of a checklist in a guide you ticked, in this browser only. | getlooky.ai (first party) | Until you clear the site data | Strictly necessary (function you requested) |
Only the statistics entries below are optional.
Statistics (only after your consent)
| Name | Type | Purpose | Provider | Duration | Category |
|---|---|---|---|---|---|
_ga | Cookie | Recognizes a browser on repeat visits, so visits and visitors can be counted. Holds a random number, not your name or email. | Google Ireland Limited (Google Analytics 4), set on getlooky.ai | 2 years | Statistics (consent) |
_ga_<container-id> | Cookie | Keeps the state of a visit (session) for the Google Analytics property. The name ends with the measurement ID without “G-”. | Google Ireland Limited (Google Analytics 4), set on getlooky.ai | 2 years | Statistics (consent) |
Google Analytics 4 is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. When you accept, Google receives your IP address and technical data of your visit (pages, time, browser, device, approximate location) and may transfer them to Google LLC in the USA. Google LLC takes part in the EU-U.S. Data Privacy Framework. We use Google Analytics in “Consent Mode” (version 2): until you accept, the storage for analytics and for advertising is set to “denied”. After you accept, only the analytics storage is granted; the settings for advertising storage, advertising user data and advertising personalization stay denied, and we run no advertising. We use the results only to improve the website and our content. More in our privacy policy.
Looky app (app.getlooky.ai)
| Name | Type | Purpose | Provider | Duration | Category |
|---|---|---|---|---|---|
better-auth.session_token (with the prefix __Secure- on the live site) | Cookie | Keeps you signed in. Set when you sign in. | Looky (first party, may be shared with other getlooky.ai subdomains) | Up to 30 days, extended while you use the app | Strictly necessary |
looky-locale | Cookie and local storage | Stores the language of the app. | Looky (first party) | 1 year (cookie), until cleared (local storage) | Strictly necessary (preference) |
looky-theme | Local storage | Light, dark or system mode. | Looky (first party) | Until you clear the site data | Strictly necessary (preference) |
looky:last-workspace, looky:last-scope | Local storage | The last workspace or organization you opened, to take you back there after signing in. | Looky (first party) | Until you clear the site data | Strictly necessary (function you requested) |
looky:recent-workspaces, looky:recent-commands | Local storage | Your recently used workspaces and commands in the quick switcher. | Looky (first party) | Until you clear the site data | Strictly necessary (function you requested) |
looky:sidebar-collapsed | Local storage | Whether the sidebar is collapsed. | Looky (first party) | Until you clear the site data | Strictly necessary (preference) |
looky:setup-guide, looky:setup-complete:<workspace>, looky:setup-visibility-skipped:<workspace> | Local storage | State of the setup guide (open or minimized, completed, skipped step). | Looky (first party) | Until you clear the site data | Strictly necessary (function you requested) |
looky:calendar-view, looky:signals-period | Local storage | Your last choice of calendar view and of the time period for AI traffic. | Looky (first party) | Until you clear the site data | Strictly necessary (preference) |
looky:onboarding, looky:pending-domain | Local storage | Where you stopped the setup, and the website address you entered before signing up. | Looky (first party) | Until the setup is finished or you clear the site data | Strictly necessary (function you requested) |
looky:signup-intent | Local storage | Remembers the plan and source you picked on the website until you finish signing up. | Looky (first party) | Until you finish signing up or clear the site data | Strictly necessary (function you requested) |
looky:wizard:<workspace>:<id>, looky:article-draft:<item>:<version> | Local storage | Local backup of a draft or wizard input while you work, so nothing is lost if the connection drops. | Looky (first party) | Until saved or you clear the site data | Strictly necessary (function you requested) |
looky:email-unverified | Local storage | Reserves space for the email verification notice so the page does not jump. | Looky (first party) | Until you verify your email or clear the site data | Strictly necessary |
looky:stage-paused | Local storage | Remembers that you paused Looky's animation on the setup screens. | Looky (first party) | Until you switch it back on or clear the site data | Strictly necessary |
looky:day-one-home | Local storage | Remembers which workspaces show the first-week home page, so the page does not jump while it loads. | Looky (first party) | Until the first-week home page ends or you clear the site data | Strictly necessary |
looky:website-platform:<workspace> | Local storage | Holds the website platform you picked on Home only until it is saved to your workspace. | Looky (first party) | Until the pick is saved, usually a few seconds | Strictly necessary |
looky:github-consent:<workspace> | Session storage | Holds that you agreed to let Looky read your repository while you are on GitHub, so the repository choice does not ask again. | Looky (first party) | Until the repository is connected or you close the tab | Strictly necessary |
looky_start | Cookie | Holds the sign-up token while you set up Looky, so a reload of the setup does not start over. Set by our API when you press "Show me" in the app, only sent to the sign-up endpoints. | Looky (first party) | 10 minutes | Strictly necessary (function you requested) |
looky:has-password | Local storage | Remembers in this browser that the account last used here has a password, so the sign-in screen offers it. | Looky (first party) | Until you sign in to an account without a password or clear the site data; signing out does not remove it | Strictly necessary |
looky:editor-kind:<id> | Session storage | Remembers which editor opens, to show the right loading screen. | Looky (first party) | Until you close the tab | Strictly necessary |
Cookies that our server sets while you use the app (they are never readable by scripts):
| Name | Type | Purpose | Provider | Duration | Category |
|---|---|---|---|---|---|
looky_oauth_<provider> (with the prefix __Secure- on the live site, for example looky_oauth_linkedin) | Cookie (HttpOnly, SameSite Lax) | Binds the connection of a channel (such as LinkedIn or Google) to the browser that started it, so nobody else can complete it. Holds a random value, set only while you connect a channel and sent only to the callback address of that provider. | Looky (first party) | 10 minutes | Strictly necessary (function you requested, § 25 (2) no. 2 TDDDG) |
Admin area (admin.getlooky.ai, Looky staff only)
The admin area is for Looky staff and is not offered to visitors or customers. It uses the cookie and storage entries below.
| Name | Type | Purpose | Provider | Duration | Category |
|---|---|---|---|---|---|
looky_admin | Cookie (HttpOnly, SameSite Strict, path /v1/admin) | Keeps a staff member signed in to the admin area after password and second factor. It is never sent to customer pages. | Looky (first party) | Until the admin session ends (limited session with an idle timeout), at most as long as the session | Strictly necessary |
looky-locale | Cookie and local storage | Stores the language of the admin area. | Looky (first party) | 1 year (cookie), until you clear the site data (local storage) | Strictly necessary (preference) |
When a staff member opens a customer workspace for support (impersonation), no extra cookie is set. That support session uses the normal app session cookie better-auth.session_token described above, is limited in time and is recorded in an audit log.
The app sets no statistics or marketing cookies and loads no Google Analytics. Files in the app (uploads, images, documents, voice recordings) load straight from our file storage, Cloudflare R2 in the EU, through links that are valid for a short time; Looky sets no cookie for this (details in the privacy policy, section 3).
Third parties
Cloudflare Turnstile (strictly necessary)
The free AI visibility check, when it is offered, the forms on the website (agency and Enterprise requests, cancel page) and the sign-up, sign-in code and password reset forms of the app load the bot protection Cloudflare Turnstile from challenges.cloudflare.com (Cloudflare, Inc., USA), only on these pages. Your browser then connects to Cloudflare, which receives your IP address and technical data of your browser (TLS fingerprint, user agent) together with the site key and the address of the page, to tell people from bots.
What it stores: in our setup, Turnstile sets no cookie on getlooky.ai or app.getlooky.ai and stores nothing in the local or session storage of our pages. The check runs in a frame of challenges.cloudflare.com, which cannot read or write the storage of our pages. Turnstile's script only writes to the local storage of a page when the site turns on its optional session continuity, and we do not. Cloudflare's Turnstile privacy addendum lists the signals Turnstile collects and states that they are strictly necessary to detect and block bots.
Why no consent is needed: under § 25 (1) TDDDG, storing information on your device or reading it needs consent, unless it is strictly necessary to provide a service you have expressly asked for (§ 25 (2) no. 2 TDDDG). You ask to sign up, to sign in, to reset your password, to run the check or to send a form. Protecting exactly these functions against bots and abuse is part of providing them securely, and the check runs only where you use them. The processing that follows rests on Art. 6 (1) (f) GDPR, our legitimate interest in keeping bots from creating accounts, triggering emails and running costly checks. We use Turnstile neither for statistics nor for advertising. Details are in our privacy policy, section 5.
Google Analytics
Google Analytics (see above) is the only other third-party service of the website, and it loads only after your consent.
How to change or withdraw your choice
- Click Cookie settings in the footer of any page, or open the cookie settings page. Switch statistics off and save, or click Reject all.
- When you withdraw, we stop measuring, remove the Google script from the page, set the analytics storage back to “denied” and delete the
_gacookies of getlooky.ai in your browser. Google keeps the data it already received according to its own retention settings. - Your choice is stored in the cookie
looky-consentfor 12 months. After that, or if you delete the cookie, the banner asks again.
Deleting or blocking cookies in your browser
You can delete cookies and site data in your browser at any time and block them in the future. The settings are usually under “Privacy” or “Privacy and security”:
- Chrome and Edge: Settings, Privacy and security, Cookies and other site data
- Firefox: Settings, Privacy & Security, Cookies and Site Data
- Safari: Settings, Privacy, Manage Website Data
If you delete or block these entries, the website keeps working. We simply won’t remember your language choice and your cookie choice, so the cookie banner appears again.
Questions
If you have questions about data protection, you can reach us using the contact details in our privacy policy.