Cookie policy

Cookies are small text files that a website places on your device to remember state between visits (for example, keeping you signed in) or to measure how the product is used. We also use related local-storage and session-storage technologies for the same purposes.

We use cookies and similar technologies on the following legal bases:

• Strictly necessary cookies: placed on the basis of Article 5(3) of the ePrivacy Directive, which exempts cookies strictly necessary for the service explicitly requested by the user. No consent is required for these, but we disclose them below.
• Analytics and preference cookies: placed only after your prior affirmative consent via the banner on first visit. Consent is the legal basis under Article 6(1)(a) GDPR and Article 4 of Moroccan Law 09-08. You can withdraw consent at any time (see §5).

We group cookies into three categories. Essential cookies cannot be declined; analytics and preference cookies are opt-in via the consent banner shown on your first visit.

• Essential, authentication session tokens (Supabase Auth), CSRF protection, workspace routing state, Cloudflare Turnstile anti-abuse cookies on anonymous endpoints. Required for the product to work.
• Analytics, PostHog product analytics (EU Cloud, Frankfurt) and Sentry error reporting. Used to understand feature usage and debug incidents. Opt-in.
• Preferences, remembers cookie consent choice, theme preference, locale selection, and recently viewed projects. Opt-in.

The concrete items we currently set (names may change as libraries update):

• sb-access-token / sb-refresh-token (Supabase session, essential, session-scoped, HttpOnly, SameSite=Lax).
• cookie-consent + cookie-consent-date (localStorage, records your consent banner choice; retained 12 months).
• ph_* (PostHog, analytics, opt-in; retained up to 13 months).
• sentry-trace (Sentry, error tracing, opt-in; session-scoped).
• cf-turnstile-* (Cloudflare Turnstile, bot mitigation on anonymous endpoints; essential).
• Next.js routing cookies for language and theme preference (opt-in preferences category).

Analytics and error reporting are handled by PostHog (product analytics) and Sentry (error tracing). Authentication session cookies are issued by Supabase. We do not run advertising or cross-site tracking cookies.

The full sub-processor list is available at /legal/sub-processors.

You can change your cookie preferences at any time:

• Use the consent banner shown on first visit or after you clear site data.
• Clear cookies and local storage from your browser to reset your choice.
• Control cookies generally via your browser settings.
• Declining analytics cookies does not affect your ability to use the Service; essential cookies remain active so authentication can work.

We do not currently respond to Do Not Track (DNT) headers because there is no consistent industry standard. We honor Global Privacy Control (GPC) signals by treating them as a decline of analytics cookies.

We may update this page as we add or remove tools. Material changes will be reflected with an updated "Last updated" date. Contact: contact@saliencylab.com.