Política de cookies

Legal disclaimer: This document is a template provided for informational purposes only. It does not constitute legal advice. You must review and customise this policy with qualified legal counsel before deploying to production or making it available to end-users.

Cookies we use#

We group cookies and similar storage into three categories. Strictly necessary cookies are always active because the Service cannot function without them. Analytics & performance and Marketing & advertising are optional: they are enabled only after you consent through our cookie banner, and you can change your choice at any time.

| Cookie / storage | Purpose | Category | Lifetime | HttpOnly | SameSite | |---|---|---|---|---|---| | sid | Session authentication — stores your encrypted session identifier so you remain logged in | Strictly necessary | 7 days (sliding) | Yes | Lax | | csrf_token | CSRF protection — stateless HMAC-SHA256 token read by client-side JavaScript to attach to mutating requests | Strictly necessary | Session | No | Lax | | observability_consent | Records your cookie choices so we can honour them on return visits | Strictly necessary | 180 days | No | Lax | | apm_attribution | First-touch marketing attribution — records which campaign referred you, so signups can be credited to the right source | Marketing & advertising | 90 days | No | Lax | | PostHog analytics (browser sessionStorage) | Product analytics — page views and anonymous usage, to help us improve the site. Not a cookie; cleared when the tab closes | Analytics & performance | Session | — | — |

sid — Session cookie#

This cookie contains an AES-256 encrypted session token. It is flagged HttpOnly so it cannot be accessed by JavaScript, and Secure in production so it is only transmitted over HTTPS. The 7-day lifetime resets on each request (sliding window). Without this cookie the Service cannot authenticate you.

csrf_token — CSRF protection token#

This cookie holds a stateless HMAC-SHA256 double-submit token. Unlike sid, it is intentionally readable by JavaScript so the client can attach it as a request header on POST/PUT/PATCH/DELETE requests. This is a standard CSRF defence pattern — the value has no session-linked secret and is validated server-side on every state-changing request. Without this cookie, form submissions and API mutations will be rejected with 403 Forbidden.

---

Consent#

Under GDPR Art. 5(3) (as incorporated by the EU ePrivacy Directive and national implementations) and the UK PECR, consent is not required for cookies that are strictly necessary to provide a service explicitly requested by the user. sid, csrf_token, and observability_consent are strictly necessary for the operation of the Service and are always active.

Analytics & performance and Marketing & advertising storage are not strictly necessary. We set them only after you opt in through the cookie banner shown on your first visit. Until you choose, no analytics or marketing storage is written. You can accept all categories, allow only the necessary ones, or pick per category. Browsers that send a Do Not Track signal are treated as a rejection of the optional categories.

---

Third-party services#

When you consent to Analytics & performance, we load PostHog to measure anonymous product usage. Requests are proxied through our own domain and PostHog stores its state in your browser's sessionStorage rather than in cookies. We never send personal data (email, name) to PostHog, and analytics never loads until you opt in. Our payment processor (Stripe) operates in its own iframe and may set cookies subject to Stripe's own cookie policy.

---

How to clear or block cookies#

You can clear or block cookies at any time through your browser settings. Note that blocking the sid cookie will prevent you from remaining logged in, and blocking csrf_token will prevent form submissions from working.

Chrome: Settings → Privacy and Security → Cookies and other site data → See all site cookies and site data

Firefox: Settings → Privacy & Security → Cookies and Site Data → Manage Data

Safari: Settings → Privacy → Manage Website Data

Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data

---

Changes to this policy#

We will update this policy if we introduce new cookies. Material changes will be announced via email or a prominent notice in the Service.

---

Contact#

For questions about this policy, contact us at [privacy@example.com] or see our Privacy Policy for full contact details.