Legal

Cookie Policy

Effective date: June 8, 2026

This Cookie Policy explains what cookies are, which ones Cloutbox uses, the legal basis for each, and your choices. For full data handling information, see our Privacy Policy.

1. What Are Cookies?

Cookies are small text files placed on your device by a website. They are used to keep you logged in, remember your preferences, and collect anonymous usage statistics. This policy also covers similar technologies such as local storage and session storage.

2. Consent Mechanism

Under the EU ePrivacy Directive (Cookie Law) and GDPR, non-essential cookies may only be set after you have given prior, freely given, specific, informed, and unambiguous consent.

When you first access Cloutbox, we present a cookie consent notice that allows you to:

Accept all — essential, preference, and analytics cookies are enabled.
Essential only — only strictly necessary cookies (required for login) are set. No analytics or preference cookies.
Manage preferences — choose individual categories.

Your consent choice is stored in a first-party cookie for 12 months and can be updated at any time via the cookie settings link in the footer. Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.

Essential cookies only until consent: we do not set analytics or preference cookies before you have confirmed your consent choice. Essential session cookies are set immediately as they are necessary to display and secure the login page.

3. Cookies We Use

Name / type	Category	Purpose	Duration	Legal basis (GDPR)	Opt-out?
sb-[project]-auth-token	Essential	Supabase authentication session — keeps you logged in	1 hour (auto-refreshed)	Contract performance (Art. 6(1)(b)) — necessary to provide the Service	No — required to use the Service
sb-[project]-auth-token-code-verifier	Essential	PKCE code verifier for secure OAuth login flow	Session	Contract performance (Art. 6(1)(b))	No
cb_consent	Essential	Stores your cookie consent choice to avoid repeated prompts	12 months	Legal obligation / legitimate interests (Art. 6(1)(f)) — required to comply with ePrivacy rules	No — records your choice
cb_sidebar_state	Preferences	Remembers sidebar collapsed/expanded state	12 months	Consent (Art. 6(1)(a))	Yes — withdraw via cookie settings
cb_theme	Preferences	Stores your UI theme preference	12 months	Consent (Art. 6(1)(a))	Yes — withdraw via cookie settings
sentry-sc (Sentry)	Analytics	Anonymous session identifier for error grouping — no PII stored	90 days	Consent (Art. 6(1)(a))	Yes — withdraw via cookie settings or contact us

4. Third-Party Cookies

Some sub-processors may set their own cookies when you use the Service:

Supabase — authentication session (essential). Privacy Policy
Sentry — anonymous error session (analytics, consent-gated). Privacy Policy
Stripe — fraud prevention (on billing pages only, essential for payment security). Privacy Policy

We do not use Google Analytics, Meta Pixel, advertising cookies, or any cross-site tracking technologies. We have no plans to add these.

IAB TCF: We do not participate in the IAB Transparency and Consent Framework as we do not work with advertising partners. If this changes, we will update this policy and implement a fully compliant CMP.

5. How to Manage Cookies

You can update your cookie preferences at any time using the cookie settings link in the site footer. You can also manage cookies at the browser level:

Chrome: Settings → Privacy and security → Cookies and other site data
Firefox: Settings → Privacy & Security → Cookies and Site Data
Safari: Preferences → Privacy → Manage Website Data
Edge: Settings → Cookies and site permissions → Manage and delete cookies

Note: disabling essential cookies will prevent you from logging in. For analytics opt-outs, contact privacy@cloutbox.ai.

6. Changes to This Policy

When we add new cookies or change how existing ones are used, we will update this policy and, where required by law, present a fresh consent notice. Questions? Contact privacy@cloutbox.ai.