Legal / 03
Cookie Notice
Last updated · August 16, 2026
Subject XYZ LLC uses a small number of first-party cookies and browser storage keys in Boxic. We use no third-party advertising cookies, no cross-site trackers, and no session replay.
| What | Key | Category | Purpose | Lifetime |
|---|---|---|---|---|
| Supabase auth token | sb-…-auth-token | Strictly necessary | Keeps you signed in and identifies your session to the backend. | Until sign-out or expiry |
| Session cookie | issued by our server runtime | Strictly necessary | Authenticates requests and protects against cross-site request forgery. | Session |
| Theme preference | boxic.theme | Preferences | Remembers light, dark, or automatic appearance. | Until cleared |
| Consent choice | boxic.consent.analytics.v1 | Strictly necessary | Remembers whether you accepted or rejected analytics. | Until cleared |
| Local project mirror | Boxic local storage | Strictly necessary | Caches your projects so the app works offline and loads fast. | Until sign-out or account switch |
| Analytics session id | boxic.session.id | Analytics | Groups page views from one visit so we can measure product usage. | Session only |
Consent
Strictly necessary and preference storage is required for Boxic to work and cannot be turned off in-product. Analytics is different: if you're in the EEA, the UK, or Switzerland, we collect nothing until you choose “Accept”. Choosing “Reject” means no page views are recorded and no session identifier is created. Elsewhere, analytics runs by default and you can turn it off below at any time.
Analytics detail
When enabled, we record the page path, referrer, coarse device information, viewport width, and a per-visit session identifier, stored in our own database and pruned after 90 days. It is never shared with ad networks and is not used to build a cross-site profile of you.
Managing storage yourself
You can clear cookies and site storage at any time in your browser settings. Doing so signs you out of Boxic and resets your preferences. To remove data tied to your account, see the Privacy Policy.