Cookie Policy

This page describes the cookies and browser storage that Daaam’s current product code uses. Authenticated users may opt in to limited product analytics. Daaam does not use advertising or cross-site behavioural tracking.

---

Cookies Daaam sets

Name	When and why it is set	Maximum lifetime	Attributes
sb-access-token	After sign-in; authenticates application requests	7 days	First-party, HttpOnly, SameSite=Lax, Secure in production
sb-refresh-token	After sign-in; renews the authenticated session	30 days	First-party, HttpOnly, SameSite=Lax, Secure in production
share_verified	After the correct password is entered for a password-protected share; remembers access	24 hours	First-party, HttpOnly, SameSite=Lax, Secure in production

Signing out deletes both Supabase session cookies. The share_verified value contains the protected share slug, a timestamp, and a cryptographic signature; it does not contain the share password.

These cookies are necessary for the authentication or protected-share feature the visitor requests. Blocking them will prevent sign-in or require a protected share password to be entered again.

Browser storage used by the waitlist

The landing-page waitlist stores one local-storage entry:

Key	Value and purpose	Functional period
loops-waitlist-last-submit-at	Timestamp only; prevents another waitlist submission within one minute	1 minute

The timestamp may remain in local storage after the one-minute check has expired until it is overwritten or you clear site data. It does not contain the submitted email address. The email itself is sent to Loops as described in the Privacy Policy.

Browser storage used by optional product analytics

Daaam loads PostHog only after an authenticated user explicitly opts in to the current notice. PostHog is configured to use local storage, not cookie persistence. Its token-scoped entries can store a pseudonymous distinct identifier, session identifiers, the current Workspace group identifier, and the analytics opt-in or opt-out state. Exact key names include the PostHog project token and may change with the SDK version.

Rejecting a renewed notice or withdrawing consent from Profile stops capture and removes Daaam’s token-scoped PostHog local- and session-storage entries, including the persisted analytics identity. This cleanup also runs when the SDK was not loaded during the current page visit. Clearing site data removes the same entries; Daaam’s server-side preference remains authoritative and prevents analytics from restarting without effective consent.

What Daaam does not currently use

• Advertising or cross-site behavioural-tracking cookies
• Marketing pixels
• Session replay, automatic interaction capture, heatmaps, surveys, exception autocapture, or Web Vitals through PostHog
• A separate infrastructure-monitoring script

Daaam’s infrastructure and external endpoints still receive ordinary request data when your browser connects to them. For example, the hosted DiceBear and Gravatar endpoints receive avatar-request data, and Loops receives a waitlist submission. Those data flows are described in the Privacy Policy; they are not Daaam analytics cookies.

Consent and changes

Daaam displays an analytics-consent choice to authenticated users before loading PostHog. The choice can be changed at any time from Profile. If Daaam materially changes the analytics purpose or data contract, the current notice version will stop applying and the application will request a new opt-in. Any other non-essential cookie or similar technology will be disclosed here and used only with consent where required.