Cookie Policy
Last Updated: September 2026 · Version 2.1
Upkilo is a product of Kornspire Private Limited (CIN: U62091PN2026PTC260635) · Incorporated in India · Governing law: DPDP Act 2023, IT Act 2000, ePrivacy Directive (EU users)
Manage your cookie preferences
You can change or withdraw your consent at any time.
1. What Are Cookies
Cookies are small text files stored on your device by your browser when you visit a website. They help websites remember your preferences, keep you logged in, and understand how the site is used.
Upkilo also uses similar technologies including localStorage (client-side browser storage) and session storage. This policy covers all such technologies.
2. Cookie Categories & Legal Basis
Required for the platform to operate. Without these cookies, services such as authentication and booking management cannot function. Consent is not required under ePrivacy Directive strictly-necessary exemption and DPDP Act 2023.
Remember your preferences (dark/light mode, language, UI layout) across sessions to personalise your experience.
Help us understand how users interact with the platform. Data is aggregated and anonymised. No personally identifiable information leaves our systems.
Track the source and effectiveness of marketing campaigns (UTM parameters, referral attribution). No data is shared with advertising networks.
3. Cookie Inventory
Complete list of cookies and storage items used by Upkilo. "S" = Session (deleted when browser closes). "P" = Persistent (retained until expiry date).
Essential Cookies
| Name | Type | Purpose | Retention | Party |
|---|---|---|---|---|
| __Host-auth_token | S/P | JWT authentication token — keeps you logged in | Session / 7 days | 1st |
| session_id | S | Server-side session identifier for stateful requests | Session | 1st |
| __Host-csrf | S | CSRF protection token for form submissions | Session | 1st |
| timezone | P | IANA timezone string for server-side time rendering (appointment times, booking dates). Contains no personal identifier. | 1 year | 1st |
Functional Storage
| Name | Storage | Purpose | Retention | Party |
|---|---|---|---|---|
| theme | localStorage | Dark/light mode preference | Indefinite (until cleared) | 1st |
| language | localStorage | Preferred interface language / locale | Indefinite | 1st |
| sidebar_collapsed | localStorage | Sidebar open/collapsed state preference | Indefinite | 1st |
Analytics Storage
| Name | Storage | Purpose | Retention | Party |
|---|---|---|---|---|
| usage_session | sessionStorage | Tracks page views and feature interactions within a single session. Aggregated server-side; PII is not stored. | Session | 1st |
| feature_flags_cache | localStorage | Caches evaluated feature flags to avoid redundant API calls | 24 hours | 1st |
Marketing Storage
| Name | Storage | Purpose | Retention | Party |
|---|---|---|---|---|
| utm_source | sessionStorage | Tracks the marketing channel that referred you (e.g., email, social, paid) | Session | 1st |
| referral_code | Cookie (upkilo.com and app.upkilo.com) | Stores the affiliate referral code from a /ref/ link so the signup can be credited to that affiliate | 30 days | 1st |
4. Consent Management
When you first visit Upkilo, a consent banner allows you to:
- Accept All — enables all cookie categories
- Reject All — only essential cookies are used
- Customise — choose individual categories with toggle switches
Your consent is stored locally and synced to our servers under GDPR Art. 7(1) for proof-of-consent purposes. Your choice is versioned: if we update our cookie practices materially, you will be prompted to re-consent.
To change your preferences at any time, click "Cookies" in the footer of any page.
5. Browser Cookie Controls
You can also control cookies through your browser settings. Note that blocking essential cookies will prevent the platform from functioning correctly.
6. Third-Party Services
Upkilo integrates the following third-party processors that may set their own cookies or access identifiers:
- Stripe (payments) — sets cookies for fraud detection and secure payment processing. Stripe Privacy Policy
- SendGrid / Twilio (email/SMS) — used only to deliver transactional messages; no tracking pixels are embedded by Upkilo
- Microsoft Azure (cloud infrastructure) — your data is processed on Azure servers; no Azure-specific tracking cookies are set
- Google Tag Manager (tag management) — loads on every page and may in turn load Google analytics and advertising tags. It runs under Google Consent Mode with every consent type denied by default, so those tags send nothing until you accept the matching category. Google Privacy Policy
Apart from Google Tag Manager and the tags it loads, Upkilo does not use Meta Pixel, HubSpot, or any other third-party advertising or analytics platform. You can change or withdraw your Analytics and Marketing choices at any time from the cookie banner, and a withdrawal takes effect immediately.
7. Do Not Track
Upkilo respects the Do Not Track (DNT) browser signal. When DNT is enabled, we disable all non-essential tracking and analytics automatically, regardless of stored cookie consent.
8. Policy Updates
We will update this Cookie Policy when we add new cookies or third-party services. Material changes will be notified via the consent banner (triggering a re-consent prompt) and via email to registered users.
9. Contact
- Privacy inquiries: privacy@upkilo.com
- Grievance Officer (India — DPDP Act / IT Act): grievance@upkilo.com · +91 75075 74166
- Full details: see our Privacy Policy