What's a cookie, briefly
A cookie is a small text file a site stores on your device. "Similar technologies" include localStorage, sessionStorage, IndexedDB, and pixels. Throughout this page, "cookie" covers all of them.
Cookies fall into two flavors:
- Strictly necessary— required for the Service to work. You can't usefully turn these off.
- Optional — analytics and preferences. You can turn these off without breaking the Service.
We do not use cookies for advertising, retargeting, or cross-site tracking.
What we set
| Name | Type | Purpose | Set by | Expiry |
|---|---|---|---|---|
| sb-access-token | Strictly necessary | Authenticated session | Supabase / us | 1 hour, refreshed |
| sb-refresh-token | Strictly necessary | Refresh access token | Supabase / us | 30 days |
| pc_csrf | Strictly necessary | CSRF protection | us | Session |
| pc_consent | Strictly necessary | Records cookie choices | us (localStorage) | 1 year |
| pc_theme | Preference | Light/dark theme | us (localStorage) | 1 year |
| pc_dismissed_banners | Preference | Dismissed in-app banners | us (localStorage) | 1 year |
| Plausible event ping | Analytics (cookieless) | Aggregated page-view counts | Plausible | none (cookieless) |
We don't set Google Analytics, Meta Pixel, TikTok Pixel, LinkedIn Insight, or any other ad-network tag. We don't use server-side advertising IDs.
Third-party cookies
- Cloudflare may set a
__cf_bmcookie for bot management. Strictly necessary, dropped after a short session. - Stripe(only on the checkout/billing pages) sets a session cookie for fraud detection while you're paying. Not used elsewhere.
- Plausible does not set cookies. It uses cookieless event pings only.
We do not embed YouTube, Vimeo, Twitter, or other social widgets that drop cookies on production pages where consent has not been granted.
Your choices
- The cookie banner on your first visit. Choose Accept all (analytics on) or Essential only (analytics off).
- The Privacy choices page — change your decision any time.
- Your browser settings. Most browsers let you block or delete cookies. If you block strictly-necessary cookies, the Service will not work.
Inside the logged-in dashboard at app.papercrane.bio we don't show the banner because the only cookies we set there are strictly necessary for auth and CSRF; analytics are not enabled in the app by default. Your dashboard preferences are stored in localStorage on your device only.
Do Not Track and Global Privacy Control
We honor the Global Privacy Control (GPC)signal as an opt-out from analytics, in addition to whatever you choose in the banner. We treat a clear GPC signal as if you selected "Essential only".
We do not separately respond to legacy DNT headers, which are ambiguous. GPC supersedes.
Changes
If we add or remove a cookie or change a purpose, we'll update this page and bump the Effective date. For material changes (new categories, new vendors), we'll re-prompt the cookie banner so you can re-decide.
Contact
Questions about cookies? Email privacy@papercrane.bio.