Cookie Policy
The cookies and browser storage we use, what each one is for, and how to control them. We use no analytics, advertising, or tracking cookies of any kind.
1. What we use
Cookies are small text files stored on your device. We also use local storage. Together they sign you in, keep you signed in, and remember how you have set the Service up.
Strictly necessary. Required for the Service to function. These cannot be disabled.
| Purpose | Type | Lifetime |
|---|---|---|
| Session refresh | Cookie (HttpOnly, Secure, SameSite=Strict, scoped to /api/auth) | 30 days |
| Remembered-session marker | Cookie (Secure, SameSite=Strict). Carries no secret | 30 days |
| Multi-factor trusted device | Cookie (HttpOnly, Secure, SameSite=Strict) | 30 days |
| Single sign-on request in flight | Cookie (Secure, SameSite=None, required for the provider’s callback). Carries no session | Minutes, cleared on completion |
Your signed-in session itself is not a cookie. The access token lives in the browser tab’s memory for 15 minutes and is re-acquired from the refresh cookie above, so closing the tab discards it. There is no cross-site request-forgery cookie either, because the API authenticates a bearer token rather than a session.
Functional. Your preferences, kept on your device so the Service looks right before your account has finished loading. Stored in your browser, not sent to our servers.
| Purpose | Type | Lifetime |
|---|---|---|
| Language and text direction | Local storage | Until cleared |
| Theme and font preference | Local storage | Until cleared |
| Currency, date format, and week start | Local storage | Until cleared |
| Table column widths and layout choices | Local storage | Until cleared |
| Record that we showed you this notice | Local storage | Until cleared |
Two categories, both in use, and no third one waiting to be switched on. We run no analytics and no advertising. There is no advertising tag, analytics tag, session replay, or tag manager anywhere in the Service or on our website, so there is no optional category for you to consent to or refuse.
2. Third parties
We self-host our fonts, styles, scripts and images on both kavvim.com and the app, so no third party learns your address from the bare fact that a page loaded.
Inside the app there is one exception that sets cookies of its own: on the screens where you enter card details, the payment form is served directly by Stripe, which is exactly what keeps those details from passing through us. Stripe sets its own cookies within that form, under its own policy. Our error monitor also receives a report when something breaks, but it sets no cookie.
The marketing site has neither, and contacts nobody but us.
3. Managing your choices
The first time you use the Kavvim application we tell you what is stored, and “Cookies we use” at the bottom of the app shows the same list again at any time. There is nothing to toggle, because neither category above is optional and we do not use any category that would be.
Our marketing site at kavvim.com is smaller than that: it has no account and no session, and the only thing it keeps on your device is the language you picked. It shows no notice because there is nothing to notify you about.
You can clear or block cookies and local storage through your browser settings. Blocking the strictly necessary ones will sign you out and keep you out. Blocking the functional ones costs you your saved appearance settings on that device, and nothing else, because they are also stored on your account.
If we ever add a category that genuinely is optional, this page gets switches and we ask before setting anything. A banner offering choices that control nothing is worse than no banner.
4. Do Not Track and Global Privacy Control
We honor the Global Privacy Control signal as a valid opt-out of the sale or sharing of personal information. Since we do not sell or share, the signal changes nothing in practice, but we record and respect it against your account rather than against this browser. Both kavvim.com and the app publish a machine-readable declaration at /.well-known/gpc.json saying so.
We do not respond to the older Do Not Track header, which lacks a common standard.
Questions: privacy@kavvim.com.