Cookie Policy
Last updated: September 15, 2026
Postward uses as few cookies as possible: only the strictly necessary ones that keep you signed in and protect sign-in flows. We do not use advertising, analytics or cross-site tracking cookies, and we do not load third-party trackers — which is why the site works without a consent banner.
1. Cookies we set
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| better-auth.session_token | Keeps you signed in to the Studio. httpOnly, Secure, tied to a server-side session you can revoke from settings. | Until you sign out (or the session expires) | Essential — first-party |
| better-auth.session_data | Short-lived cache of session metadata so requests skip a database lookup. | 60 seconds | Essential — first-party |
| better-auth.state / nonce cookies | Transient anti-CSRF values during the Google sign-in round-trip. Set at the start of the flow and consumed when it finishes. | Minutes (single flow) | Essential — first-party |
| better-auth.no_prompt_tmp | Internal Better Auth cookie used during provider callbacks. | Minutes (single flow) | Essential — first-party |
Exact names may carry a __Secure- prefix depending on your browser requirements, and a dev/local variant exists on localhost.
2. Cookies we do not set
- No analytics or product-analytics cookies (no Google Analytics, PostHog, Hotjar or similar).
- No advertising or retargeting cookies.
- No social-media tracking pixels.
- No AI/model-provider cookies — your content never passes through third-party AI services on our side.
One exception to note honestly: the billing portal and checkout are Stripe-hosted pages, and Stripe sets its own cookies there under its own policy. Those pages run on stripe.com’s domain, not ours.
3. Local storage and similar technologies
We do not use localStorage/sessionStorage for tracking. Interface preferences (for example your selected theme) may be stored locally on your device and never leave your browser.
4. Managing cookies
Because all cookies here are strictly necessary for the service you asked for (staying signed in), they cannot be disabled without breaking sign-in. You can always clear them from your browser settings or sign out, which invalidates the server-side session immediately. Browser-level controls (Do Not Track, third-party cookie blocking) have no effect on the product’s functionality because we set no third-party cookies.
5. Changes and contact
If we ever introduce optional analytics, we will update this page with an updated date and ask for consent before anything non-essential is set. Questions: privacy@postward.cc.