Cookie Policy

Auth.js session cookie (`__Secure-authjs.session-token` on production HTTPS, or `authjs.session-token` in a local non-HTTPS environment): keeps a signed-in user authenticated. It is HttpOnly, uses SameSite=Lax, is Secure in production and expires after up to 30 days.

`kord_last_workspace` and `kord_last_workspace_path`: remember the last client or brand and stable app section so sign-in can return the user to the expected place. They use SameSite=Lax and expire after up to one year.

`kord_impersonate`: an HttpOnly, Secure, SameSite=Lax administrative support cookie used only when an authorized platform administrator deliberately starts a restricted support impersonation session. It expires after up to eight hours or when the session is stopped.

Legacy `pouster_*` names may be read once during the KORD migration and are then deleted. New values are written only under the `kord_*` names.

Public sign-in and registration forms use Cloudflare Turnstile to distinguish legitimate users from automated abuse. Cloudflare may process IP address, browser and device signals and may set strictly necessary security values. KORD sends the challenge response and, where available, the request IP to Cloudflare for verification.

Turnstile is a security control, not an advertising or cross-site behavioral analytics tool used by KORD.

• Cloudflare Privacy Policy - Cloudflare's information about its data processing

`kord:lastSelectedChannels:<workspace>` stores the IDs of the active social profiles most recently selected in the composer, so a new draft can restore that functional choice.

A scoped `kord:*:media-publish-filter` value remembers whether the media library shows all, published or unpublished media for that user and workspace.

`kord:billing-currency` remembers the currency selected on Pricing or Billing so later price views stay consistent. It does not set or change an active subscription.

`kord:advanced:<section>` remembers whether an optional advanced settings section is expanded on that browser.

These values remain in that browser until replaced, removed by KORD's migration logic or cleared by the user. They do not authenticate the user and are not shared across workspaces.

The current KORD website and app do not set KORD advertising, retargeting or cross-site profiling cookies. We do not require an optional analytics cookie to provide the service.

Public website pages load cookieless usage statistics from the operator's self-hosted Umami instance. It stores nothing on your device, counts page views and sign-up button clicks in aggregate and is skipped when your browser sends Do Not Track. Signed-in pages do not load it.

If we add optional analytics or marketing technology, we will update this policy and provide a consent control before non-essential storage is used where required by law.

You can remove cookies and local storage through browser settings. Blocking the authentication or security cookies will prevent sign-in or protected app functions. Clearing functional values only resets remembered workspace, channel, media-filter, currency and advanced-section choices.

Questions about browser storage or privacy can be sent to [email protected].