Cookie Policy

1. What are cookies?

Cookies are small text files stored on your device by your web browser when you visit a website. They serve various purposes such as remembering your preferences, keeping you signed in, and helping us understand how our platform is used. Some cookies are strictly necessary for the site to function; others are optional and require your consent.

2. Essential cookies

These cookies are required for the platform to function correctly. They cannot be disabled without breaking core functionality.

• Access token (auth_token): Keeps you signed in while you use the platform. HttpOnly, SameSite=Strict, Secure; cannot be read by JavaScript and is only sent to our servers.
• Refresh token (refresh_token): Lets your session renew without asking you to sign in again. HttpOnly, SameSite=Strict, Secure.
• CSRF token (csrf_token): Protects against cross-site request forgery. HMAC-signed double-submit cookie validated on every state-changing request. This one is deliberately readable by JavaScript, because the browser must echo it back in a request header; on its own it grants no access.
• Trusted device (trusted_device): Set when you tick Remember me at sign-in. There is no separate "trust this device" control: the same tickbox both lengthens your session and stops this browser re-prompting for two-factor authentication. HttpOnly, SameSite=Strict; expires after 30 days. Until 2026-09-15 this entry described a dedicated opt-in that does not exist.
• Sign-in flow state (oauth_state / __Host-oauth_state, and oauth_remember): Set only when you sign in with Google, GitHub, or your institution's single sign-on. They tie the sign-in round trip to your browser so a third party cannot complete it on your behalf, and they carry your "remember me" choice across the redirect. HttpOnly; expire after 10 minutes and are cleared as soon as the sign-in completes.
• Two-factor sign-in state (pending_2fa_session / __Host-pending_2fa_session): Set only when your sign-in needs a second factor (security key, authenticator app, or emailed code). It ties the half-finished sign-in to the browser that started it, so the pending-session token alone is not enough for someone else to complete your login. HttpOnly, SameSite=Lax, Secure; expires after 10 minutes, and the sign-in it protects expires after 5.
• Cookie consent preferences (fcm_cookie_consent): Stored in localStorage, not as a cookie, to remember your cookie consent choices so we don't repeatedly prompt you. Kept for 6 months, after which we ask again, as the French data protection authority (CNIL) recommends.

Administrators acting on a support request may additionally hold two short-lived session cookies (impersonating and original_admin, HttpOnly, 15-minute maximum) on their own browsers. These are never set on your browser.

3. Optional analytics cookies

These cookies are only set if you explicitly consent via the cookie banner or the privacy preferences panel. They help us understand how visitors use the platform so we can improve the experience.

• PostHog Analytics: When you consent to analytics, PostHog may set cookies to track page views, feature usage, and session information. No PII is sent to PostHog — user IDs are pseudonymized before transmission. You can opt out anytime through the privacy preferences panel.
• Vercel Analytics and Speed Insights: gated by this same analytics consent, but set no cookies themselves; they measure page views and load performance on the dashboard and AI-sandbox pages only, and stop loading if you have Do Not Track or Global Privacy Control on. Vercel sees your IP address and page/performance data as an ordinary part of serving the request.

3a. Server-side security telemetry (legitimate interest)

Separately from the consent-gated analytics, we send a limited set of security-related events to PostHog from our servers — regardless of cookie consent — under the legal basis of legitimate interest (GDPR Art. 6(1)(f)) for fraud prevention and security monitoring.

These events include: failed and successful authentication attempts, password resets, two-factor verification outcomes, account lockouts, data export and erasure requests, CSRF and rate-limit violations, and suspicious access patterns. Events are tagged in PostHog with category=security and data_basis=legitimate_interest.

What we never include in security telemetry: email addresses, IP addresses (only short non-reversible HMAC fingerprints for grouping), passwords, tokens, survey response contents, or anything that would allow re-identification of an individual outside our internal audit log.

You may request deletion of security-telemetry records via our Data Rights Portal or by contacting [email protected]. We may retain a minimum subset of security records (e.g., account-takeover indicators) for the period required under Article 32, with anonymization applied where feasible.

4. Third-party cookies

We use a limited number of third-party services that may set their own cookies:

• PostHog (analytics): Sets cookies to track anonymous usage data when you have consented to analytics. PostHog processes data per their privacy policy. Only activated when you accept analytics cookies.
• Sentry (error tracking): Used for error monitoring and performance tracking when you have consented to analytics cookies, including session replay on a sample of sessions (10% of ordinary sessions, all sessions that hit an error). Replay masks all on-screen text and blocks all media before anything leaves your browser, so a recording shows page structure and interaction timing, not the words or images you saw. May use cookies or local storage to correlate error reports. All PII is scrubbed via a beforeSend hook before transmission. The frontend Sentry SDK is consent-gated — it loads only when analytics consent is granted and respects the Do Not Track browser signal. When you revoke analytics consent, the Sentry client is closed and any associated state is cleared. (Backend error monitoring, which never sees end-user devices, runs unconditionally for production reliability.)
• Cloudflare Turnstile (bot protection): Sets challenge-response cookies on the account forms: signup, forgot-password (the widget sits on the login page, but it guards the reset request rather than the sign-in), password reset, contact, and the waitlist. It is not applied to the sign-in submission itself; until 2026-09-15 this line said it was. No tracking; challenge response only. Strictly necessary for platform security.
• Cloudflare Turnstile (bot protection on survey submission): When a survey response is submitted, Turnstile runs a privacy-preserving challenge and returns a pass or fail. The result is recorded for quality review and never blocks the submission. Turnstile does not use cookies to track you across sites and is not used for advertising. Google reCAPTCHA Enterprise performed this role until 2026-09-16 and was removed; Google no longer receives anything from a survey submission.

We do not use any marketing or advertising cookies. We do not sell or share cookie data with advertisers.

5. How to manage cookies

5.1 Privacy preferences banner

When you first visit the platform, a cookie consent banner offers three choices: Accept (enables all cookies), Reject (disables non-essential cookies), or Manage (opens a detailed preferences panel where you can toggle individual cookie categories). Your choice, whether you accept or reject, is remembered for 6 months.

5.2 Updating your preferences

You can change your cookie preferences at any time using the button below, or via the Privacy Policy page.

5.3 Browser settings

You can also control cookies through your browser settings. Blocking essential cookies may prevent you from signing in or using the platform.

• Chrome: Settings → Privacy and Security → Cookies and other site data
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Edge: Settings → Cookies and site permissions → Cookies and site data

6. Data retention

Essential cookies persist only for the duration of your session or until the configured timeout. Analytics cookies set by PostHog follow PostHog's default retention policies and are cleared when you revoke analytics consent. Your consent preferences are stored for 6 months before we ask again.

7. Changes to this policy

We may update this Cookie Policy. Changes will be reflected by updating the "Last Updated" date. If we make material changes, we will re-prompt you for consent.

8. More information

For more details about how we handle your personal data, see our Privacy Policy. Questions about cookies or your privacy: [email protected].

Cookie settings

Manage your cookie preferences at any time:

Manage cookie preferences