Cookie & Tracking Notice

What this notice covers

This notice explains the cookies and similar technologies used on the pages the Company operates: our marketing site, signup, and the customer dashboard. It is part of our Privacy Policy.

Websites our customers build are configured by those customers. Their own cookie or privacy notice governs their site. We describe our built-in site analytics here so both customers and their visitors can see how it behaves.

What these technologies are

A cookie is a small file a site stores in your browser and reads on later visits. Similar technologies include local storage and session storage, which hold data in the browser; service workers, which cache files so a page can load quickly or work offline; and tracking pixels, which are tiny images used to record that a page was opened.

We do not use advertising pixels, advertising networks, or cross-site tracking technology on our own pages.

Strictly necessary cookies and storage we use

These are required for the Service to work. Blocking them will prevent sign-in and other core features.

• Session cookie. Identifies your signed-in session. It is HttpOnly, marked Secure in production, and uses SameSite=Lax. We store only a hash of the session token on our servers, and you can revoke sessions from the dashboard.
• Cross-site request forgery token. A readable cookie whose value is bound to your session and checked on every change you make, so another site cannot act as you.
• Sign-in and verification state. Short-lived values that support email verification, password reset, and two-factor authentication.
• Preferences and consent. Stores interface preferences and the consent choices made on a site, so you are not asked repeatedly.
• Bot protection. When enabled, Cloudflare Turnstile sets storage needed to tell a person from an automated script on public forms.
• Payments. During checkout or in the billing portal, Stripe sets its own cookies on the pages it controls, for fraud prevention and to complete the payment.
• Offline support. Our installable app registers a service worker that caches interface files. It does not track you across sites.
• Push notifications. If you enable browser notifications, your browser stores a subscription that lets us deliver the messages you asked for.

Analytics and performance

We measure how our own product is used with bounded operational events such as signup, template selection, editor engagement, and publication. These records do not contain page bodies, form answers, AI prompts, or raw visitor identifiers, and they are not shared with advertising networks.

When error reporting is enabled, Sentry receives technical diagnostic information about failures so we can fix them.

Customer websites and optional technology

Each customer chooses a consent mode for their site and decides which categories to enable. Built-in first-party analytics is designed to be privacy-minimizing: it hashes visitor and session identifiers with a coarse IP prefix, stores no raw IP address, strips query strings from paths, keeps only a referring hostname, and can run in a cookieless daily aggregation mode.

A customer may also enable optional analytics, marketing technology, or third-party embeds such as maps, video players, chat widgets, or social feeds. Where consent is required, the site should wait for that choice before loading the technology, and those third parties then set their own cookies under their own policies.

The customer is responsible for configuring these settings correctly and for publishing a notice that matches what their site actually does.

Your choices

• Use the consent controls shown on a site to accept or decline optional categories, and to change your mind later.
• Change your browser settings to block or delete cookies and storage. Blocking strictly necessary items will break sign-in and other features.
• Revoke notification permission in your browser at any time to stop push messages.
• Clear site data in your browser to remove stored preferences and consent choices.

Because we do not sell personal information or share it for cross-context behavioral advertising, a Global Privacy Control or Do Not Track signal does not change how we process information on our own pages. Where a state law treats a Global Privacy Control signal as a valid opt-out request that applies to us, we honor it.

Changes to this notice

If our use of cookies or similar technology changes in a material way, we will publish a new version of this notice with a new effective date.