Cookie policy

A cookie is a small piece of text a website asks your browser to store and send back on your next request. This document covers cookies and anything comparable, including data kept in your browser’s local storage, which is not a cookie but is storage on your device and is treated the same way here.

It sits beside the privacy policy, which describes everything else we hold and why. Where the two overlap, they say the same thing on purpose.

Three cookies, and one entry in local storage. That is the whole list, and it is the list whether you have an account or not.

• The session cookie. Set by our authentication provider, Supabase, when you sign in. It is what tells the server on your next request that you are still you. Its name begins sb- and ends -auth-token. Without it there is no way to stay signed in from one page to the next, so it is strictly necessary in the literal sense of the phrase.
• The refresh cookie. Set alongside it and by the same provider. Access tokens are deliberately short-lived, so this is what lets the server quietly renew yours instead of signing you out every hour. It carries the same name prefix and is written back on every navigation that renews it.
• The current workspace cookie, ws. Ours. It holds the identifier of the workspace you last switched to, so that opening the product puts you back where you were. It is written only when you switch workspace or create one, it holds an identifier and nothing else, and it is read on the server to decide which workspace to load. If you belong to one workspace it never changes.
• Your theme preference, in local storage. The value is light, dark or nothing. It is written by your browser and read by your browser, and it is never sent to us: it exists so a dark-theme page does not flash white before it loads. We could not read it if we wanted to, because it is never attached to a request.

The two authentication cookies and the workspace cookie are set only for people signing in. Reading the public pages of this site sets nothing at all.

The session cookie expires within hours and is renewed while you are using the service. The refresh cookie lasts longer, which is what keeps you signed in between visits, and it is invalidated the moment you sign out. The workspace cookie lasts a year unless you change workspace or clear it.

Signing out clears the authentication cookies immediately, on the server as well as in your browser: the session behind them is revoked rather than merely forgotten.

Consent is required for storage that is not strictly necessary for a service you asked for. Every item in section 2 is necessary in that sense: two of them are how you stay signed in, one of them is which workspace you are looking at, and the fourth never leaves your device. None of them profiles you, follows you to another site, or is shared with anybody.

So there is nothing here to consent to, and a banner asking you to accept cookies we are allowed to set regardless would be theatre. If that ever changes, the banner arrives in the same release as the cookie, and this section is rewritten to say what the new one does.

There is no analytics cookie, no advertising pixel, no tag manager, no session recorder, no chat widget and no social embed on this service. That is not an oversight we intend to fix quietly: it is a property of the product, and it is one of the few compliance answers here that is unambiguously simple.

Payment is handled by Stripe. If you open a payment or billing page hosted by Stripe, Stripe sets its own cookies under its own policy, on its own domain, for fraud prevention. That happens on Stripe’s pages rather than ours, and Stripe is a controller in its own right for it.

Every browser can block or delete cookies, and you can do that here without asking us. The consequence is worth stating plainly: blocking the two authentication cookies makes signing in impossible, because there is no other way for the server to recognise you on the next request. Blocking only the workspace cookie is harmless and simply means you land on your first workspace each time.

Clearing local storage resets your theme to whatever your operating system prefers.

If the list in section 2 changes, this document changes with it and the date at the top moves. We will not add a tracking cookie and describe it here afterwards.

Questions about any of this go to hello@crestnote.com, the same address the privacy policy gives.