Cookie Policy
Every cookie and storage key we set, named individually, with what it does and how to turn the optional ones off.
Last updated: August 26, 2026
On this page
What This Covers
This policy explains the cookies, local storage keys and similar technologies used on innoutstores.com and in the IN N’ OUT Rewards web app. A cookie is a small file a site stores in your browser. Local storage is a similar browser store that persists until it is cleared. We use both, sparingly, and we tell you exactly what for. This policy is part of, and should be read with, our Privacy Policy.
The Three Categories
Strictly necessary. Required to deliver the site and to keep you signed in to Rewards. These cannot be switched off through our banner because the site cannot function without them, and no consent is required for them under Minnesota, California or comparable state law. We do not use them for advertising.
Preferences. Remember choices you made, such as your consent selection itself and whether you dismissed a prompt. Set only in your browser, never used to build a profile.
Analytics. Optional and off unless you accept. These tell us which pages get used so we can fix the ones that do not. We use our own first-party analytics service; we do not load Google Analytics, advertising pixels, or any cross-site tracker.
What we never do: we do not sell or share your personal information for cross-context behavioral advertising, we do not load third-party advertising or social media tracking pixels, we do not use device fingerprinting, and we do not access any mobile advertising identifier.
Every Cookie and Storage Key We Set
| Name | Type | Category | Purpose | Lifetime |
|---|---|---|---|---|
innout_session | HTTP cookie, HttpOnly, Secure, SameSite | Strictly necessary | Keeps you signed in to your Rewards account. Cannot be read by page scripts. | Session, or up to 30 days if you stay signed in |
innout_cookie_consent | Local storage | Preferences | Records your banner choice and the policy version it applied to, so we stop asking. | 12 months |
innout_install_dismissed | Local storage | Preferences | Remembers that you dismissed the “add to home screen” prompt. | 12 months |
innout_visitor / innout_sess | Local storage | Analytics (opt-in) | Daily-rotating pseudonymous visit and session identifiers used only for aggregate counts. Set only after you accept analytics. | Rotates daily; cleared on withdrawal |
| Service worker cache | Cache Storage | Strictly necessary | Stores site files offline so pages load fast and work with a weak signal. Contains no personal information. | Until you clear site data |
__cf_bm, cf_clearance | HTTP cookie (Cloudflare) | Strictly necessary | Bot management and security challenge state set by our infrastructure provider. | 30 minutes to 1 year |
Third Parties That May Set Something
- Cloudflare — serves and protects this site and may set the security cookies listed above, and may run its cookieless aggregate Web Analytics beacon. See Cloudflare’s privacy policy.
- Google Fonts — we load two typefaces from Google’s font CDN. Google receives the request and your IP address to deliver the file. Google states it sets no cookies for font requests.
- Google Maps — the map embed on our Home and Contact pages is loaded from Google and may set Google cookies once it loads. If you would rather not load it, our address and directions are in plain text beside it.
We receive no advertising revenue and run no ad network. No third party is permitted to use data from this site to target you elsewhere.
Global Privacy Control
This site honors the Global Privacy Control signal. If your browser or extension sends GPC, we treat it as an opt-out of any sale or sharing of your personal information and we do not enable optional analytics, without you doing anything else. Because we do not sell or share personal information in the first place, GPC changes nothing about how we treat you — but we honor it regardless.
Manage Your Choices Right Now
Use the button below to reopen the consent banner and change your selection at any time. Withdrawing analytics consent takes effect immediately and clears the analytics keys from this browser.
Your current setting on this browser: checking…
Browser-Level Controls
You can block or delete cookies for this or any site in your browser settings — Chrome, Safari, Firefox and Edge all offer per-site controls under Privacy or Site Settings. Blocking strictly necessary cookies will sign you out of Rewards and may break parts of the site. Clearing site data also removes your saved consent choice, so the banner will ask again.
Changes
If we add a technology or change a category, we will update this page, bump the consent version, and ask you again. Questions: [email protected].