Cookie Policy
- Effective
- October 17, 2026
- Last updated
- October 17, 2026
Costnip uses cookies and browser storage for sign-in, security, location preferences and drafts. Optional measurements are off until you accept them. This page lists every one.
The short version
- Necessary cookies keep you signed in, protect forms from bots and remember your cookie choice.
- Preference cookies and browser storage keep the place you chose and unfinished forms. Drafts disappear when you close the tab.
- Optional analytics are off until you accept, and stay off if your browser sends Do Not Track or Global Privacy Control.
- No advertising or cross-site tracking cookies, ever. Embedded Costnip cards set no cookies at all.
- Change your choice any time with “Cookie settings” in the footer.
This summary helps you read the full text below. It isn’t part of the agreement. If they differ, the full text applies.
1. What cookies and browser storage are
Cookies are small text files a website stores in your browser and sends back on later requests. Browser storage is similar but stays on your device: “session storage” is wiped when you close the tab, and “local storage” persists across tabs and browser restarts. This policy lists every one Costnip uses. It’s part of our Privacy Policy.
2. The categories we use
| Category | What it does | Your choice |
|---|---|---|
| CategoryNecessary | What it doesKeeps you signed in, protects forms from bots and remembers your cookie choice. The site can’t work without them. | Your choiceAlways on. You can block them in your browser, but then you can’t sign in. |
| CategoryPreferences | What it doesRemembers the place you chose, form drafts and where “Back” should go. | Your choiceAlways on, because they only store choices you made. Clear them from the location menu or by closing the tab. |
| CategoryOptional analytics | What it doesUsage and performance measurements. On older resource pages, Google Analytics or Google Tag Manager when configured. | Your choiceOff until you accept. Change it any time in “Cookie settings”. |
| CategoryThird-party, on request | What it doesGoogle Maps and Disqus comments on older resource pages set their own cookies when you choose to load them. | Your choiceEach asks before loading. The choice lasts for that page visit. |
We don’t use advertising or cross-site tracking cookies. The full lists are in section 3 (The cookies we use) and section 4 (Browser storage).
3. The cookies we use
| Name | Category | What it does | How long |
|---|---|---|---|
Namecn_session | CategoryNecessary | What it doesKeeps you signed in. Can’t be read by page scripts. | How long14 days without use, 30 days at most, or until you sign out |
Namecn_merge_from | CategoryNecessary | What it doesIf you shared anonymously and then sign in, a signed note that lets us attach what you shared to your account. Can’t be read by page scripts. | How long30 minutes during sign-in; up to 7 days after a merge is offered |
Namesb-…-auth-token | CategoryNecessary | What it doesSet by our sign-in provider (Supabase) while you sign in and stay signed in. May be split into numbered parts. | How longUntil you sign out or it expires |
Namesb-…-code-verifier | CategoryNecessary | What it doesA one-time security check when you sign in with Apple or Google. | How longUntil the sign-in flow clears it or it expires |
Namecn_zip | CategoryPreferences | What it doesThe ZIP or postal code you chose, to sort results by distance. | How long1 year, or until you clear it |
Namecn_country | CategoryPreferences | What it doesThe country you chose. | How long1 year, or until you clear it |
Namecn_location_mode | CategoryPreferences | What it doesRemembers that you picked a place yourself rather than using the approximate one. | How long1 year, or until you clear it |
Cookies set by providers
- Our network provider, Cloudflare, may set a short-lived security cookie (such as
__cf_bm, about 30 minutes) to tell people from harmful bots, and its Turnstile bot check on forms may set a similar one. They aren’t used to track you. - On older resource pages, Google Analytics (
_ga,_ga_…,_gid,_gat; up to 2 years) is set only after you accept optional analytics. Rejecting or withdrawing removes them. - Google Maps and Disqus on older resource pages set their own cookies only after you choose to load them. Their privacy policies, linked in our Privacy Policy, describe them.
4. Browser storage
| Name | Type | What it does | How long |
|---|---|---|---|
Namecookie_consent | TypeLocal storage | What it doesRemembers your cookie choice and when it expires. | How longPreferences are valid for 180 days; the stored record remains until replaced or cleared |
Namecn_share_v2 | TypeSession storage | What it doesKeeps what you typed in the share form if you sign in halfway through. | How longUntil you close the tab |
Namecn_back_stack | TypeSession storage | What it doesMakes the “Back to…” link at the top of pages go to the right place. | How longUntil you close the tab |
Namecostnip_pending_save | TypeSession storage | What it doesRemembers the item you tried to save before signing in, so we can finish saving it. | How longUsed within an hour, or until you close the tab |
Namecostnip_save_confirmation | TypeSession storage | What it doesShows the “Saved” confirmation after you return to the page. | How longRemoved as soon as it’s shown |
Namecostnip_hospital_alert_draft:… | TypeSession storage | What it doesKeeps your hospital price update choices if you sign in halfway through. | How longUntil you finish, or close the tab |
Nameuser, bill, returnToUrl, recentFaqSearches | TypeLocal storage (older resource pages) | What it doesSign-in state, a bill you were working on, where to return after sign-in, and recent help searches on older pages. | How longUntil you sign out or clear them |
None of this leaves your browser except to Costnip when you complete the action it belongs to.
5. Measurements, analytics and loaded services
Usage measurements on price-sharing pages. If you accept optional analytics, your browser sends simple events such as page-speed timings and “comparison viewed” to Costnip. We store them only as daily counts by page type and device. No cookie, identifier or IP address is stored with them, and nothing is sent if your browser sends “Do Not Track” or Global Privacy Control, or if you reject optional analytics.
Google analytics on older resource pages. Google Analytics or Google Tag Manager, when configured, load only after you accept optional analytics. Rejecting blocks the scripts. Withdrawing consent removes known Google analytics cookies and reloads the page to stop scripts already loaded. We don’t enable advertising storage or personalization.
Services you choose to load. Older resource pages offer Google Maps and Disqus comments. Each loads only after you use its “Allow and load” control, and the provider may then set its own cookies. You can stop it with the reload control or by rejecting optional cookies. The choice lasts for that page visit.
Maps. Maps on our price-sharing pages load tiles from OpenFreeMap. Your browser contacts its servers directly, which exposes your IP address. No cookies are set.
6. Costnip cards on other websites
Other sites can embed a Costnip comparison card. Cards are plain pages with no scripts and set no cookies or storage, and they send no referrer to us. The site you’re visiting may use its own cookies; its policy applies to those.
7. Your choices
- Cookie settings. Use “Cookie settings” in the footer, or the button below, to accept, reject or change optional analytics. Your choice is kept for 180 days, then we ask again. If storage is blocked, your choice applies for this visit and we may ask again next time.
- What we keep. Your choice lives in your browser. We also keep an anonymous record that a choice was made (which choice, when, the policy version and whether a privacy signal applied), with no IP address, account or cookie value, for two years. Nothing optional loads until you accept.
- Browser signals. If your browser sends “Do Not Track” or Global Privacy Control, optional analytics stay off and we won’t ask.
- Browser settings. You can block or delete cookies and storage in your browser. If you block necessary cookies, you won’t be able to sign in, and Costnip won’t remember the place you chose.
- Your chosen place. Clear it at any time from the location menu at the top of the site.
8. More information
See our Privacy Policy for how we handle personal information, or email privacy@costnip.com. We update this page whenever we add or remove a cookie or storage key; see the version history below.
Version history
- October 17, 2026Grouped cookies by category, added the sign-in merge cookie and every browser storage key, explained usage measurements and the anonymous record of your choice, and confirmed that embedded Costnip cards set no cookies.
- October 5, 2026First published version.
Earlier versions are available on request from legal@costnip.com.