← Back to home
Cookie Policy
Last updated: 24 September 2026 · Co-Founder AI · lists only storage and tracking actually present in the product
1. Analytics notice
- Essential sign-in and product storage always stays on — the app cannot work without it.
- Analytics (Vercel Analytics + Speed Insights + Google Analytics) load on every page for all visitors.
- Our footer links to this policy on every page.
2. Essential and functional storage (always on)
These keep you signed in and remember product settings. The frontend never reads the httpOnly session cookie with JavaScript — it only asks the backend who is signed in.
| Name | Category | Purpose | Duration | Provider |
|---|---|---|---|---|
| cofounder_sessionEssential | Essential · authentication | Keeps you signed in. HMAC-signed, httpOnly session cookie set and read only by the backend; JavaScript cannot read it. | Per SESSION_MAX_AGE_DAYS on the backend (default 30 days); cleared on logout. | Co-Founder (backend API) |
| cofounder.session (localStorage)Essential | Essential · authentication | Caches your signed-in user id, email, display name and onboarding state so the app shell loads without an extra round-trip. | Persists until you sign out or clear site data. | Co-Founder (frontend) |
| Supabase auth session (localStorage)Essential | Essential · authentication | Stores the Supabase PKCE session used only for Google sign-in and the /auth/callback exchange. The backend verifies it and never trusts profile fields sent from the browser. | Managed by Supabase Auth (persist + auto-refresh); cleared on sign-out or when site data is cleared. Exact lifetime is governed by the Supabase project settings. | Supabase Auth |
| cofounder-landing-theme (localStorage)Essential | Functional · preferences | Remembers your landing-page theme choice. | Persists until cleared. | Co-Founder (frontend) |
| cofounder:tour:v1:* · cofounder:tour:armed:*Essential | Functional · preferences | Remembers whether the product tour was completed (localStorage) and whether it is armed for the session (sessionStorage). | Completion flag persists until cleared; armed flag lasts for the tab session. | Co-Founder (frontend) |
| cofounder:onboarding-credit-award (sessionStorage)Essential | Functional · onboarding | One-time flag used to surface the onboarding credit grant. | Tab session only. | Co-Founder (frontend) |
| cofounder_logo_* (sessionStorage)Essential | Functional · product state | Caches logo status and whether the add-logo prompt was dismissed, to avoid repeated checks. | Tab session only. | Co-Founder (frontend) |
| cofounder:mobile-notice-seen (localStorage)Essential | Functional · preferences | Remembers that the small-screen notice was dismissed. | Persists until cleared. | Co-Founder (frontend) |
3. Analytics (always on)
| Name | Category | Purpose | Duration | Provider |
|---|---|---|---|---|
| Vercel Analytics + Speed InsightsOptional | Analytics (always on) | Aggregate page-view and web-performance measurement. Loads on every page. | No cookies are set by Co-Founder for this. Measurement requests go to Vercel; retention on Vercel's side is governed by Vercel's policies (not verified in our code). | Vercel |
| _ga · _ga_<container-id> (Google Analytics 4)Optional | Analytics (always on) | Aggregate page-view and usage measurement via gtag.js (measurement ID G-W5TRPHEGJD). Loads on every page. | _ga persists up to 2 years, _ga_<container-id> up to 2 years in this browser; governed by Google's policies. Requests go to www.googletagmanager.com / www.google-analytics.com. | Google Analytics |
- Analytics do not break sign-in, chat, files, billing, or OAuth — they only measure usage.
- You can block analytics with a browser content blocker or by disabling JavaScript; the product still works.
4. Third-party content that loads with the product
- Razorpay Checkout script (checkout.razorpay.com) loads only on the billing page when you pay. Card details go directly to Razorpay — we never see or store them.
- Currency-rate lookups on the billing page (Frankfurter, ExchangeRate-API, jsDelivr currency API) fetch public FX rates; no account data is sent to them.
- Fonts load via next/font/google (build-optimised). Font delivery involves requests to Google's font infrastructure.
- The landing footer shows a Product Hunt badge image (api.producthunt.com). Loading it sends standard web-request data (such as IP address and referrer) to Product Hunt.
- Google OAuth (via Supabase) and Instagram/Meta OAuth run only when you choose to sign in or connect an integration.
5. What we do not use
- No Meta Pixel, and no advertising or cross-site tracking cookies.
- No JavaScript access to the session cookie (no document.cookie reads/writes for auth).
- No sale of personal information (see Privacy Policy).
6. Managing storage yourself
- Clearing site data / cookies in your browser signs you out and resets theme and tour choices.
- Blocking essential storage will break sign-in and core product features.
Also see our Privacy Policy and Terms and Conditions.