Cookie Policy
The cookies and browser storage we use, what each one is for, and how to control them. We use no analytics, advertising, or tracking cookies of any kind.
1. What we use
Cookies are small text files stored on your device. We also use local storage. Together they sign you in, keep you signed in, and remember how you have set the Service up.
Strictly necessary. Required for the Service to function. These cannot be disabled.
| Purpose | Type | Lifetime |
|---|---|---|
| Session refresh | Cookie (HttpOnly, Secure, SameSite=Strict, scoped to /api/auth) | 30 days |
| Remembered-session marker | Cookie (Secure, SameSite=Strict). Carries no secret | 30 days |
| Multi-factor trusted device | Cookie (HttpOnly, Secure, SameSite=Strict) | 30 days |
| Single sign-on request in flight | Cookie (Secure, SameSite=None, required for the provider’s callback). Carries no session | Minutes, cleared on completion |
Your signed-in session itself is not a cookie. The access token lives in the browser tab’s memory for 15 minutes and is re-acquired from the refresh cookie above, so closing the tab discards it. There is no cross-site request-forgery cookie either, because the API authenticates a bearer token rather than a session.
Functional. Your preferences, kept on your device so the Service looks right before your account has finished loading. Stored in your browser, not sent to our servers.
| Purpose | Type | Lifetime |
|---|---|---|
| Language and text direction | Local storage | Until cleared |
| Theme and font preference | Local storage | Until cleared |
| Currency, date format, and week start | Local storage | Until cleared |
| Table column widths and layout choices | Local storage | Until cleared |
| Record that we showed you this notice | Local storage | Until cleared |
Two categories, both in use, and no third one waiting to be switched on. We run no analytics and no advertising. There is no advertising tag, analytics tag, session replay, or tag manager anywhere in the Service or on our website, so there is no optional category for you to consent to or refuse.
2. The mobile app
The Kavvim app for iPhone and Android uses no cookies. It keeps the following on the phone instead, and none of it is sent anywhere except the sign-in tokens, which go only to Kavvim to keep you signed in.
| Purpose | Where on the phone | Lifetime |
|---|---|---|
| Session refresh | Secure storage (iPhone Keychain, Android Keystore), this phone only | 30 days, removed when you sign out |
| Multi-factor trusted device | Secure storage (iPhone Keychain, Android Keystore), this phone only | 30 days |
| Your preferences, as in the Functional table above | The app’s private storage | Until you delete the app |
| A copy of the projects you open, with their photos, to view with no signal | The app’s private storage | Until you sign out; anything not refreshed for 30 days is dropped |
| Whether Lock the app is on | The app’s private storage | Until you turn it off or delete the app |
Our Privacy Policy, under The Kavvim mobile app, lists what the copy of your projects contains and what it never contains. The app tells you about all of this the first time you open it, in a notice headed A word about your data.
3. Third parties
We self-host our fonts, styles, scripts and images on both kavvim.com and the app, so no third party learns your address from the bare fact that a page loaded.
Inside the app there is one exception that sets cookies of its own: on the screens where you enter card details, the payment form is served directly by Stripe, which is exactly what keeps those details from passing through us. Stripe sets its own cookies within that form, under its own policy. Our error monitor also receives a report when something breaks, but it sets no cookie.
Choosing to sign in with Google sends your browser to Google’s own sign-in page, where Google applies its own cookies under its own policy. That happens on Google’s site rather than inside ours, and only if you press that button.
The marketing site has none of these, and contacts nobody but us.
4. Managing your choices
The first time you use the Kavvim application we tell you what is stored, and “Cookies we use” at the bottom of the app shows the same list again at any time. There is nothing to toggle, because neither category above is optional and we do not use any category that would be.
Our marketing site at kavvim.com is smaller than that: it has no account and no session, and the only thing it keeps on your device is the language you picked. It shows no notice because there is nothing to notify you about.
You can clear or block cookies and local storage through your browser settings. Blocking the strictly necessary ones will sign you out and keep you out. Blocking the functional ones costs you your saved appearance settings on that device, and nothing else, because they are also stored on your account.
If we ever add a category that genuinely is optional, this page gets switches and we ask before setting anything. A banner offering choices that control nothing is worse than no banner.
5. Do Not Track and Global Privacy Control
We honor the Global Privacy Control signal as a valid opt-out of the sale or sharing of personal information. Since we do not sell or share, the signal changes nothing in practice, but we record and respect it against your account rather than against this browser. Both kavvim.com and the app publish a machine-readable declaration at /.well-known/gpc.json saying so.
We do not respond to the older Do Not Track header, which lacks a common standard.
Questions: privacy@kavvim.com.