Cookie Policy

Overview

This policy describes how PrivyDeck uses cookies and similar browser storage. We do not use advertising, product-analytics, or social-media tracking cookies on pages we control.

Strictly necessary cookies (first-party)

• Sign-in session cookie (typically authjs.session-token, or __Secure-authjs.session-token on HTTPS): keeps you signed in; duration: session or up to about 30 days; purpose: authentication; legal basis: contract / legitimate interest
• Sign-in CSRF cookie (when using certain providers; typically authjs.csrf-token or __Host-authjs.csrf-token): protects OAuth and sign-in flows; purpose: security
• privydeck-csrf: protects against cross-site request forgery on mutating API actions from the signed-in app; duration: session; sameSite: Lax; purpose: security
• privydeck-gpc: set when we detect a Global Privacy Control signal (Sec-GPC: 1); duration: up to 1 year; purpose: record your sale/share/targeted-advertising opt-out preference; sameSite: Lax

Under EU ePrivacy rules, these cookies are strictly necessary for the service you request (sign-in, security, and honoring a privacy control) and do not require consent. We show an informational notice on first visit.

Third-party payment cookies (Stripe)

Audits may list Stripe as a detected tracker. This is expected when you use paid features:

• Stripe Checkout and the billing portal load Stripe-hosted scripts to process payments
• Stripe may set cookies for fraud prevention, session management, and payment completion
• Category: payment processing (not advertising or cross-site behavioral tracking for us)
• Data controller for payment card details: Stripe (see stripe.com/privacy)
• These cookies load only when you initiate checkout or open the billing portal, not on every page

You can avoid Stripe cookies by staying on the free tier. To manage cookies, use your browser settings or block third-party cookies (checkout may not work).

Cloud AI (xAI) is not a cookie

Optional cloud AI tips call xAI from our servers when you opt in. We do not load xAI scripts or set xAI cookies in your browser. See the Privacy Policy for what metadata is sent.

Other third-party cookies

OAuth providers (Google, GitHub, Apple) may set cookies during sign-in under their own policies. We do not control those cookies. Optional third-party services you open outside PrivyDeck (for example a privacy DNS provider dashboard) have their own policies.

Browser storage (not cookies)

• privydeck-cookie-notice-dismissed (localStorage): remembers that you dismissed the cookie notice
• privydeck-vault-passphrase-set (sessionStorage): session hint that a vault passphrase was set locally; does not store the passphrase
• privydeck-pending-passkey-ticket / privydeck-pending-callback (sessionStorage): temporary passkey sign-in flow state; cleared after use
• Service worker cache (PWA): offline copies of app assets; no vault contents
• Web Push permission and subscription objects (browser-managed): only if you enable push notifications

The browser extension may store allowlist entries, a local policy-change log, and the last verified rule snapshots on your device so it can block trackers and roll back a bad update. That storage stays on your device except for account-linked sync metadata described in the Privacy Policy.

Your choices (ePrivacy / GDPR)

Strictly necessary first-party cookies are required for sign-in and security. Stripe cookies are required only for payment flows. We do not run optional analytics or marketing cookies, so there is no separate marketing cookie opt-out.

You can clear cookies and site data in your browser. Clearing session cookies will sign you out. Global Privacy Control signals are honored as described on Do Not Sell or Share.

For questions, email privacy@privydeck.com. See also Privacy Policy and Your Privacy Rights.