Legal
Cookie Policy
Last updated: July 28, 2026
1. What cookies and local storage are
A cookie is a small text file a website places on your device. Kashboard also uses localStorage and sessionStorage — similar browser-side storage mechanisms — for the same kinds of purposes described here. In this policy, "cookies" refers to all three unless we say otherwise.
2. Categories we use
Kashboard classifies storage into four categories, matching our consent banner:
- Strictly necessary — required for the site to work: login session, CSRF/security, load-balancing, and remembering your consent choices. Cannot be disabled.
- Preferences — remember UI choices such as your accent colour, the selected business, and the review-queue mode.
- Analytics — anonymous or pseudonymous usage data used to improve the product. Off by default. Kashboard does not currently deploy a third-party analytics vendor (see § 5).
- Marketing — attribution for ads or campaigns. Off by default. Kashboard does not currently deploy marketing cookies (see § 5).
3. Cookie and storage inventory
The following items may be set on your device when you use Kashboard. Duration "Session" means it clears when you close the browser tab.
| Name | Type | Category | Purpose | Duration |
|---|---|---|---|---|
| sb-<project>-auth-token | localStorage | Strictly necessary | Keeps you signed in to your Kashboard account. | Until sign-out |
| kashboard.consent.v1 | localStorage | Strictly necessary | Stores your cookie preferences so we don't ask again. | 12 months |
| kashboard.accent | localStorage | Preferences | Remembers your chosen accent colour (green / violet / coral). | Persistent |
| kashboard.business | localStorage | Preferences | Remembers which business workspace you had selected. | Persistent |
| kashboard.review-mode | localStorage | Preferences | Remembers Swipe vs. Shoebox mode in the review queue. | Persistent |
| __cf_bm | Cookie (Cloudflare) | Strictly necessary | Cloudflare bot-management token, used to distinguish humans from bots. | 30 minutes |
| __stripe_mid / __stripe_sid | Cookie (Stripe, set during checkout) | Strictly necessary | Fraud prevention and maintaining the Stripe checkout session during purchase. | Session |
We keep this inventory current. If a category changes we update this list and re-prompt for consent when required.
4. Third-party services that may set cookies
Some functionality is provided by third parties who may set their own cookies on their own domains when their code runs:
- Stripe (payments, merchant of record) — sets cookies during checkout for fraud prevention and to remember your checkout session. See Stripe's Privacy Policy.
- Supabase (auth and database) — sets a first-party auth cookie / localStorage entry on kashboard.app so you stay signed in. Strictly necessary.
- Cloudflare (delivery, security) — may set strictly-necessary cookies such as
__cf_bmfor bot management. - Font providers (Google Fonts, Fontshare) — serve fonts from their CDNs. They do not set cookies on kashboard.app, but they receive your IP as part of the network request.
5. Analytics vendors
Kashboard does not currently use Google Analytics, Meta Pixel, TikTok Pixel, Mixpanel, PostHog, Amplitude, Hotjar, FullStory, or any similar third-party analytics or session-replay vendor on the marketing site or in the app. We rely on server-side logs and error diagnostics only.
If we add a third-party analytics vendor in the future, we will list it here, re-prompt for consent, and only load it after you opt in through the "Analytics" category in the preference center.
6. Manage your consent
Use the preference center to review and change your choices at any time. Necessary cookies remain on because the site cannot function without them.
Your choices are stored in the kashboard.consent.v1 localStorage entry on your device. Clearing your browser storage will reset them and we will ask again.
7. Browser-level controls
You can also block or delete cookies directly in your browser. Doing so may break parts of Kashboard that rely on strictly-necessary cookies (for example, staying signed in). Instructions:
8. Global Privacy Control and Do Not Track
Kashboard does not sell or share personal information for cross-context behavioural advertising (see our California Privacy Rights), so there is currently nothing to opt out of via GPC. If that ever changes, we will honor a Global Privacy Control signal from your browser as a valid opt-out.
We do not respond to legacy Do Not Track (DNT) headers because there is no consistent industry standard. Use the preference center instead — it is the authoritative control.
9. Changes to this policy
We may update this Cookie Policy from time to time. If we make material changes we will update the "Last updated" date above and, where required, re-prompt you for consent.
10. Contact
Entity: Omnaxis LLC (trading as Kashboard) — the controller responsible for the cookies and local storage described in this policy.
Questions about cookies or your consent choices can be sent to contact@kashboard.app.