Cookie Policy

This Cookie Policy explains how Glade API ("Glade API," "we," "us," or "our") uses cookies, local storage, and similar technologies when you visit or interact with our websites, accounts, dashboard, playground, and related services.

It should be read with our Privacy Policy, which explains how we process personal information. This policy addresses browser and device storage. It does not cover server-side operational records that do not read from or write to your device.

---

1. What Are Cookies and Similar Technologies?

Cookies are small text files stored on your browser or device. They can keep a user signed in, protect a session, remember preferences, or help a service understand how a site is used. First-party cookies are set for the Glade API domain. Third-party services may set their own cookies when you interact with their sites or embedded services.

We also use technologies such as local storage, which stores information in your browser but works differently from a cookie. References to "cookies" in this policy include similar storage and access technologies unless we distinguish them.

---

2. How We Use Storage Technologies

Glade API uses cookies and similar technologies to:

• authenticate users and maintain secure sessions;
• protect the Service by applying browser-level abuse and rate controls;
• remember service choices, such as the selected organization and dashboard navigation state;
• operate requested tools, including a bounded free playground allowance;
• remember your analytics choice; and
• understand and improve the Service, including privacy-masked analytics and session replay, only after you allow browser analytics.

---

3. Storage Technologies We Use

Names and durations may vary slightly when a provider changes its implementation. The tables below describe the storage Glade API intentionally uses and its expected purpose.

3.1 Strictly Necessary and Service-Control Storage

These technologies support authentication, security, tenant selection, policy acceptance, or a feature you request. Disabling them may prevent the Service from working correctly.

Cookie or storage key	Provider	Purpose	Typical duration
Supabase authentication cookies, including sb-<project-ref>-auth-token and chunked variants	Glade API / Supabase	Establish, refresh, and authenticate a signed-in session.	Determined by the authentication session and refreshed as needed.
glade_browser_id cookie	Glade API	Applies browser-level login and public-tool limits and helps prevent abuse. It is HTTP-only and cannot be read by page scripts.	Up to 400 days.
glade_policy_consent cookie	Glade API	Carries a signed, single-flow acknowledgement of the current Terms and Privacy Policy through Google authentication. It is HTTP-only and restricted to authentication paths.	Up to 10 minutes.
glade_org_id cookie	Glade API	Remembers the organization selected after accepting an invitation so the correct tenant context can be loaded. It is HTTP-only.	Up to one year.
glade_playground_visitor_id:v1 in local storage	Glade API	Applies the daily allowance when you choose to run the public live playground.	Until browser storage is cleared.

3.2 Preference and Functional Storage

These technologies remember a choice you make. Core content remains available without the dashboard preference key.

Storage key	Provider	Purpose	Typical duration
glade_analytics_consent in local storage	Glade API	Records whether you allowed or declined optional browser analytics so we can respect the most recent choice.	Until you change the choice or clear browser storage.
glade-dashboard-sidebar in local storage	Glade API	Remembers whether an authenticated user expanded or collapsed dashboard navigation.	Until changed or browser storage is cleared.

3.3 Optional Analytics and Attribution Storage

We initialize browser analytics in an opted-out state. The following technologies are used only after you select Allow analytics:

Cookie or storage key	Provider	Purpose	Typical duration
PostHog storage, including ph_*_posthog and related keys	PostHog	Records pseudonymous product events, normalized page paths, technical context, and privacy-masked session replay to help us understand reliability and product usage.	According to the configured PostHog lifespan, generally up to one year unless cleared sooner.
glade_first_referrer in local storage	Glade API	Remembers a normalized external referring site for first-touch checkout attribution.	Until analytics are declined or browser storage is cleared.
glade_first_landing_url in local storage	Glade API	Remembers the first landing path and permitted campaign parameters for first-touch checkout attribution.	Until analytics are declined or browser storage is cleared.

Browser analytics does not intentionally include API Keys, authorization headers, provider payloads, response bodies, billing details, authenticated search inputs, or free-form customer content. Session replay masks form inputs and page text and is disabled on API-key, billing, request-log, and onboarding routes. It may also block any element marked as private by the application.

Declining analytics stops future browser capture and removes Glade API's optional first-touch attribution keys. It does not affect essential authentication or security cookies, and it does not prevent you from using the core Service.

3.4 Advertising and Cross-Site Tracking

Glade API does not currently use advertising cookies or share browser activity for cross-context behavioral advertising. If this changes, we will update this policy and request any consent required before activating those technologies.

---

4. Analytics, Error Monitoring, and Session Replay

PostHog provides our consent-based browser analytics, client exception capture, and privacy-masked session replay. When analytics are allowed, PostHog may receive a pseudonymous browser identifier, normalized page path, device or browser details, allowlisted interaction events, and masked replay data.

Glade API also sends limited server-side operational events to help secure, meter, and troubleshoot the Service. Server-side events do not rely on browser cookies, are not controlled by the browser analytics preference, and exclude API request and response payloads. They are described in our Privacy Policy.

---

5. Third-Party Storage During Authentication and Payment

When you choose Continue with Google, your browser leaves Glade API for Google's authentication service. Google may set or read its own cookies on its domains during that flow. Those cookies are governed by Google's Privacy Policy, not this policy.

When an authorized administrator opens Stripe Checkout or the Stripe billing portal, Stripe may set or read cookies on its domains for payment security, fraud prevention, and checkout operation. Those cookies are governed by Stripe's Privacy Policy.

Glade API does not control storage set by a third party on that party's domain. Returning from Google or Stripe may cause Glade API to set or refresh the first-party session cookies described above.

---

6. Managing Your Preferences

6.1 On Glade API

Use Change cookie preferences near the start of this policy to reopen the analytics preference panel. Selecting Allow analytics opts the browser into PostHog capture and permits the optional attribution keys described above. Selecting Decline opts the browser out of future PostHog capture and removes those Glade attribution keys.

Your choice is device- and browser-specific. Clearing browser storage removes the saved choice, and the preference panel will be shown again on a later visit when browser analytics is configured.

6.2 In Your Browser

Most browsers let you view, delete, or block cookies and local storage through privacy or site-data settings. Blocking strictly necessary cookies may prevent login, organization selection, or requested public tools from working. Clearing Supabase authentication cookies signs you out.

Browser controls may not remove information already transmitted before you changed a setting. The Privacy Policy explains applicable rights concerning information already collected.

---

7. International Data Transfers

PostHog, Google, Stripe, Supabase, and infrastructure providers may process information in countries other than the country where you live. Where applicable law requires transfer safeguards, Glade API relies on an adequacy decision, approved contractual terms, or another recognized mechanism, as described in the Privacy Policy.

---

8. Changes to This Policy

We may update this Cookie Policy when storage names, purposes, providers, consent controls, or legal requirements change. We will update the "Last Updated" date and, where required, provide additional notice or ask for a new choice before a materially different optional technology is activated.

---

9. Contact Us

For questions or concerns about this Cookie Policy or Glade API's use of storage technologies, contact:

Glade API
Email: [email protected]