Cookie Policy
Last updated · 2026-10-20
What cookies are
Cookies are small text files that a website stores in your browser. We use them for three things: keeping you signed in, keeping the signing flow secure, and measuring how the marketing site performs. Everything else — advertising, cross-site tracking, third-party retargeting — we don't do.
Strictly necessary cookies
These cookies make the product work and can't be turned off. Disabling them prevents login + signing entirely. We don't need consent for these under PIPEDA or GDPR because they're strictly necessary to deliver the service you requested.
| Name | Purpose | Duration | Party |
|---|---|---|---|
| sb-<project>-auth-token | Supabase auth session — keeps you signed in to /app. | 400 days | First-party |
| keendraft_signer_<envelope> | Magic-link signing session, one per document. Set when a recipient opens their signing link (after their access code, if the sender set one), cleared when they sign, decline, or confirm they have viewed it. | 2 hours | First-party |
| keendraft_inbox | Signer inbox session. Set when you confirm the emailed link to see the documents sent to your email address without an account. | 24 hours | First-party |
| keendraft_pw_recovery | Set when you use a password-reset link, so only that browser can choose the new password. Cleared once you do. | 30 minutes | First-party |
| keendraft_via | Growth-loop attribution. Set when you reach signup from a KeenDraft link inside a document or email, read once at signup, then deleted. | 30 days | First-party |
| keendraft_utm | Campaign attribution. Set when you arrive from a link tagged with a campaign (utm_source), and recorded with your organization if you sign up. Holds only the campaign labels, nothing about you. | 30 days | First-party |
| theme | Remembers your light / dark / system theme preference. | No expiry (localStorage) | First-party |
Analytics cookies (optional)
When you accept the cookie banner we enable PostHog product analytics. PostHog records page views, a few named actions (such as joining the waitlist), and the rough city / country your IP resolves to — all first-party data we use to understand which marketing pages convert and which app flows confuse people. We do not share this with advertisers.
| Name | Purpose | Duration | Party |
|---|---|---|---|
| ph_<project>_posthog | PostHog session + anonymous distinct_id, with a copy in localStorage under the same name. Only set when you accept cookies in the banner. | 1 year | First-party (PostHog) |
You can change your mind any time using Cookie preferences in the footer. Choosing "Reject" opts you out and clears the existing analytics cookies on the next page load.
What we don't use
We don't use advertising cookies, cross-site retargeting pixels (Meta, Google Ads, TikTok, etc.), third-party fingerprinting, or session-replay services. If we ever change that, this page and the cookie banner will be updated and existing consent will be re-prompted.
How to control cookies
The fastest route is the Cookie preferences link in the footer of every page — it lets you accept or reject analytics in one click. You can also clear cookies from your browser at any time; doing so signs you out of /app and re-triggers the banner.
Updates to this policy
When we change what we collect we'll bump the "Last updated" date and reset analytics consent so visitors see the banner again.
Contact
Questions: privacy@keendraft.com.