Cookie Policy

This page describes the cookies and browser storage that Daaam’s current product code uses. Authenticated users may opt in to limited product analytics. Daaam does not use advertising or cross-site behavioural tracking.

---

Cookies Daaam sets

Name	When and why it is set	Maximum lifetime	Attributes
sb-access-token	After sign-in; authenticates application requests	7 days	First-party, HttpOnly, SameSite=Lax, Secure in production
sb-refresh-token	After sign-in; renews the authenticated session	30 days	First-party, HttpOnly, SameSite=Lax, Secure in production
share_verified	After the correct password is entered for a password-protected share; remembers access	24 hours	First-party, HttpOnly, SameSite=Lax, Secure in production

Signing out deletes both Supabase session cookies. The share_verified value contains the protected share slug, a timestamp, and a cryptographic signature; it does not contain the share password.

These cookies are necessary for the authentication or protected-share feature the visitor requests. Blocking them will prevent sign-in or require a protected share password to be entered again.

Browser storage used by the waitlist

The landing-page waitlist stores one local-storage entry:

Key	Value and purpose	Functional period
loops-waitlist-last-submit-at	Timestamp only; prevents another waitlist submission within one minute	1 minute

The timestamp may remain in local storage after the one-minute check has expired until it is overwritten or you clear site data. It does not contain the submitted email address. The email itself is sent to Loops as described in the Privacy Policy.

Browser storage used by optional product analytics

Daaam loads PostHog only after an authenticated user explicitly opts in to the current notice. PostHog is configured to use local storage, not cookie persistence. Its token-scoped entries can store a pseudonymous distinct identifier, session identifiers, the current Workspace group identifier, and the analytics opt-in or opt-out state. Exact key names include the PostHog project token and may change with the SDK version.

Rejecting a renewed notice or withdrawing consent from Profile stops capture and removes Daaam’s token-scoped PostHog local- and session-storage entries, including the persisted analytics identity. This cleanup also runs when the SDK was not loaded during the current page visit. Clearing site data removes the same entries; Daaam’s server-side preference remains authoritative and prevents analytics from restarting without effective consent.

Operational exception tracking

Daaam loads a separate PostHog client for operational exception capture so we can diagnose unexpected application failures. This path is not controlled by the product-analytics consent preference. The error-tracking client is configured with memory-only persistence: it does not write cookies or durable local or session storage for exception capture. Reloading or closing the tab clears that in-memory state.

When product-analytics consent is effective, the error client may attach the same pseudonymous account and Workspace identifiers used for optional analytics. Withdrawing consent or rejecting the current notice resets the error client to an anonymous state. See Operational exception tracking in the Privacy Policy for the data sent, retention, and legal basis.

Daaam loads a second always-on PostHog client for the optional in-app feedback form. It is also configured with memory-only persistence and writes no cookies or durable local or session storage. It sends data only when you submit the form, and its use is not controlled by the product-analytics consent preference. See In-app feedback in the Privacy Policy for the data sent, retention, and legal basis.

What Daaam does not currently use

• Advertising or cross-site behavioural-tracking cookies
• Marketing pixels
• Session replay, automatic interaction capture, heatmaps, automatically displayed or auto-rendered surveys, PostHog exception autocapture, or Web Vitals through the product-analytics PostHog client. The in-app feedback form emits a survey sent event only when you submit it (see In-app feedback); Daaam does not display PostHog’s automatic survey popups.

Daaam’s infrastructure and external endpoints still receive ordinary request data when your browser connects to them. For example, the hosted DiceBear and Gravatar endpoints receive avatar-request data, and Loops receives a waitlist submission. Those data flows are described in the Privacy Policy; they are not Daaam analytics cookies.

Consent and changes

Daaam displays an analytics-consent choice to authenticated users before loading PostHog. The choice can be changed at any time from Profile. If Daaam materially changes the analytics purpose or data contract, the current notice version will stop applying and the application will request a new opt-in. Any other non-essential cookie or similar technology will be disclosed here and used only with consent where required.