Cookie Policy
Last updated · 2026-05-23
What cookies are
Cookies are small text files that a website stores in your browser. We use them for three things: keeping you signed in, keeping the signing flow secure, and measuring how the marketing site performs. Everything else — advertising, cross-site tracking, third-party retargeting — we don't do.
Strictly necessary cookies
These cookies make the product work and can't be turned off. Disabling them prevents login + signing entirely. We don't need consent for these under PIPEDA or GDPR because they're strictly necessary to deliver the service you requested.
| Name | Purpose | Duration | Party |
|---|---|---|---|
| sb-access-token / sb-refresh-token | Supabase auth session — keeps you signed in to /app. | Up to 1 year | First-party |
| keendraft_signer_session | Magic-link signing session. Set when a recipient verifies their access code, cleared on completion / decline. | Session + 24h | First-party |
| keendraft_ref | Referral attribution. Set when you click a /r/ link, read once at signup, then deleted. | 30 days | First-party |
| theme | Remembers your light / dark / system theme preference. | 1 year (localStorage) | First-party |
Analytics cookies (optional)
When you accept the cookie banner we enable PostHog product analytics. PostHog records page views, clicks, and the rough city / country your IP resolves to — all first-party data we use to understand which marketing pages convert and which app flows confuse people. We do not share this with advertisers.
| Name | Purpose | Duration | Party |
|---|---|---|---|
| ph_<project>_posthog | PostHog session + anonymous distinct_id. Only set when you accept cookies in the banner. | 1 year | First-party (PostHog) |
You can change your mind any time using Cookie preferencesin the footer. Choosing "Reject" opts you out and clears the existing analytics cookies on the next page load.
What we don't use
We don't use advertising cookies, cross-site retargeting pixels (Meta, Google Ads, TikTok, etc.), third-party fingerprinting, or session-replay services. If we ever change that, this page and the cookie banner will be updated and existing consent will be re-prompted.
How to control cookies
The fastest route is the Cookie preferences link in the footer of every page — it lets you accept or reject analytics in one click. You can also clear cookies from your browser at any time; doing so signs you out of /app and re-triggers the banner.
Updates to this policy
When we change what we collect we'll bump the "Last updated" date and reset analytics consent so visitors see the banner again.
Contact
Questions: privacy@keendraft.com.