Cookie statement
Effective January 1, 2027.
Short answer: pxcmail.com sets no cookies and loads nothing from advertising or analytics companies, so there is no banner to click. The applications (the console, webmail and the locked-delivery reading pages) set a small number of strictly necessary cookies so that a sign-in or a one-time code works, and nothing else. The full list is below, with what each one does, how long it lasts and how to control it.
This website (pxcmail.com)
Sets no cookies and loads no third-party trackers. Traffic is measured with self-hosted, cookie-less analytics that store no personal identifiers. Because nothing is stored on your device and nothing is sold or shared, there is no consent banner.
Advertising landing pages (pxcmail.com/lp/…)
No cookies. Campaign parameters in the URL (utm, gclid, fbclid) are read only when you submit a form and are stored with your request to attribute it; conversions are reported to advertising platforms server-side using hashed identifiers, not with pixels.
The applications (console, webmail, locked-delivery pages)
| Cookie | Purpose | Type | Duration |
|---|---|---|---|
pxc_session | Keeps you signed in; CSRF protection | Strictly necessary | Session; idle timeout per your organization’s policy |
pxc_mfa_device | Remembers a device you chose to trust for MFA (if enabled by your organization) | Strictly necessary / functional | 30 days |
pxc_prefs | Language and display preferences | Functional | 1 year |
pxc_read | On locked-delivery pages: ties the one-time code to your browser for the reading session | Strictly necessary | Until the message is closed or 1 hour |
No analytics or advertising cookies are set in the applications.
What a cookie is, and what we use instead
A cookie is a small text record a website asks your browser to store and send back on later visits. Sites use them to keep you signed in, to remember settings, and often to track you across sites for advertising. We use them for the first two purposes only, inside the applications, where a session cannot work without one. On the marketing site we need none: pages are static, forms submit without a stored identifier, and traffic counts come from self-hosted analytics with no personal identifiers.
Browser storage
Webmail may use local storage to cache folder lists and drafts for performance; no message content is retained beyond 24 hours, and signing out clears it. The console uses local storage only for display state such as which panel was last open; it holds no message content and no credentials.
How to check for yourself
Open any page on pxcmail.com, open your browser’s developer tools (F12 on Windows, Option-Command-I on a Mac), choose the Application or Storage tab and look under Cookies. The list for pxcmail.com is empty. The Network tab shows requests to pxcmail.com and to our content delivery network only; no third-party domains. An auditor or carrier can repeat this check without asking us.
Your choices
You may block cookies in your browser; the applications will not work without strictly necessary cookies. We honor Global Privacy Control as an opt-out signal where applicable (there is nothing to opt out of on this site). For the optional ones: pxc_mfa_device is set only if you choose “remember this device” at MFA and only if your organization allows it, and you can clear it from your browser or ask your Admin to require MFA on every sign-in, which disables it; pxc_prefs is set only after you change a language or display preference. Signing out deletes the session cookie and the reading-session cookie immediately. The idle timeout for sessions is set by your organization’s Owner or Admin under Console → Security.
Changes to this statement
If we ever add a cookie, we will list it here first, with its purpose and duration, before it is set. Any cookie that is not strictly necessary would be opt-in. The effective date at the top changes when the statement changes.
FAQ
Do the locked-delivery reading pages track recipients?
No. The reading page sets one cookie, pxc_read, that ties the one-time code to the browser for that session and expires when the message is closed or after an hour. The open is recorded in the sender’s audit trail because the sender needs it; no advertising or analytics identifier is involved.
Do you use Google Analytics, Meta Pixel or similar?
No. Traffic is measured with self-hosted, cookie-less analytics, and advertising conversions on the landing pages are reported server-side with hashed identifiers, not with pixels.
Does webmail store my mail in the browser?
Webmail may cache folder lists and drafts in local storage for performance. Nothing is retained beyond 24 hours, and signing out clears it. On a shared computer, sign out.
Why does our HIPAA risk assessment ask about cookies?
Because HHS has published guidance on tracking technologies on patient-facing pages. The reading pages your patients open contain no tracking technology, and this statement is the document to cite.
Questions: [email protected].