# Cookie Notice

Version: 2026-08-05

This Cookie Notice explains how d5s uses cookies and similar browser storage on its public websites and application. It supplements the Privacy Notice.

“Cookies” below includes HTTP cookies, local storage, session storage, and similar device technologies.

## 1. Consent

Strictly necessary technologies are used to provide security, authentication, requested features, and user-selected settings and do not rely on consent where applicable law permits.

We will request consent before using non-essential analytics, advertising, personalisation, or tracking technology where required. If we ask for consent, refusing will be as easy as accepting, and you will be able to withdraw it later without losing core access.

d5s does not use advertising, cross-site tracking, session replay, or active web-analytics technology on its public websites or in the application. d5s will update this Notice and obtain consent where required before enabling such technology.

## 2. Strictly necessary cookies

### d5s_refresh

- Host/path: `.d5s.tech` domain and `/api/v1` path.
- Type: secure, HTTP-only, SameSite=Lax refresh-token cookie.
- Purpose: maintain an authenticated web session and issue short-lived access tokens.
- Lifetime: up to 30 days, rotated during refresh and removed and revoked at logout.
- Provider: d5s.

### d5s_slack_link

- Host/path: API host and Slack identity-link path.
- Type: secure, HTTP-only, SameSite=Lax short-lived flow cookie.
- Purpose: securely complete a user-requested link between a Slack identity and a d5s account without placing the credential in a query string.
- Lifetime: 10 minutes.
- Provider: d5s.

### d5s_artifact_preview_token

- Host/path: API host and the relevant sandbox artifact-preview path.
- Type: secure, HTTP-only, SameSite=Lax.
- Purpose: authorise related assets loaded by a user-requested sandbox artifact preview.
- Lifetime: 5 minutes.
- Provider: d5s.

### d5s_artifact_version_preview_token

- Host/path: API host and the relevant versioned artifact-preview path.
- Type: secure, HTTP-only, SameSite=Lax.
- Purpose: authorise related assets loaded by a user-requested immutable artifact preview.
- Lifetime: 5 minutes.
- Provider: d5s.

### Authentication-provider cookies

WorkOS or an enabled enterprise identity provider may set strictly necessary cookies on its own domain during login, logout, multi-factor authentication, or identity administration. The WorkOS login flow uses:

- `__Host-state-<id>` — host-only, secure, HTTP-only, SameSite=Lax state cookie, lasting up to 24 hours;
- `__cf_bm` — Cloudflare bot-management cookie on the AuthKit domain, lasting about 30 minutes;
- `_cfuvid` — Cloudflare security cookie on the AuthKit domain, lasting for the browser session; and
- `initiate_login_context` — transient login context that is deleted immediately after use.

These provider-domain security cookies are separate from the optional d5s Turnstile integration described below.

## 3. Application local storage

The application uses local storage for authentication tokens and user-selected state. Local storage is available to scripts running on the application origin, so d5s protects the application with technical controls and does not intentionally expose these values to third-party marketing scripts.

### Authentication

- `access_token` — short-lived access token used for API requests.
- `access_token_expires_at` — expiry time used to refresh or clear the access token.
- Lifetime: until expiry/logout or manual browser-data removal.

### User preferences and workspace state

Examples include:

- `d5s:theme` — selected theme;
- `d5s:selected-model` and `d5s:selected-model-reasoning` — selected model and reasoning preference;
- `d5s.artifactPreview.width` — artifact panel width;
- `d5s:sidebar.recents.filter` — recent-conversation filter;
- `d5s:suggested-agents.dismissed` — dismissed suggestions;
- `d5s:project.setup.open` — project-setup state;
- `d5s:composer.web-search.enabled:{workspaceSlug}` — workspace-scoped web-search preference;
- `d5s:sidebar.*.open.v2` — sidebar section state;
- `d5s:greeting.*:{userId}` — user-scoped greeting state;
- `d5s.ask.dismissed.{conversationId}` — dismissed conversation prompts;
- `d5s.draft.edits.{conversationId}` — user-edited draft subjects and message bodies; and
- `d5s.suggestion.outcomes.{conversationId}` — conversation suggestion outcomes.

Purpose: remember choices, restore in-progress interface state, and avoid repeating dismissed prompts.
Lifetime: generally until changed, cleared by the relevant feature, or removed through browser controls. Logout removes the two authentication keys but does not generally clear preferences, conversation-scoped state, or draft edits.
Data: preference values, user/workspace/conversation/tool identifiers, and, for draft-edit keys, user-entered subject and message content.

### Debug preference

- `d5s:debug` — user-enabled diagnostic mode.
- Purpose: retain a local troubleshooting preference.
- Lifetime: until changed or browser data is removed.

## 4. Session storage

Session storage is cleared when the relevant browser tab/session ends.

Examples include:

- `d5s:stale-chunk-reload-at` — prevents repeated reload loops after a deployment;
- `d5s:start-rail[:workspaceId]` — workspace setup inputs, agent instructions, cadence, and selected communication destinations;
- `d5s:morning-brief-wizard[:workspaceId]` and `d5s:morning-brief-wizard:additional-draft:{workspaceId}` — schedule, voice, destination, and credential identifiers;
- `d5s.agent-wizard.{conversationId}.{toolCallId}` — agent instructions, persona, model, budget, timezone, connectors, and channel selections; and
- `d5s.billing.topUpIntent:{organizationId}` — top-up amount, prior balance, Stripe Checkout Session identifier, and settlement/dismissal state.

Logout does not generally clear current-tab session storage. It ends when the browser tab/session ends or when the user removes browser data.

## 5. Analytics and diagnostics

### Vercel Web Analytics

- Current status: inactive on the public pages and in the authenticated application shell.
- Cookies/storage: none. d5s does not load a Vercel Web Analytics script and sets no related cookie or browser-storage identifier.
- Change control: d5s will update this Notice, and obtain consent where required, before enabling Web Analytics.

### Sentry

- Current browser status: the application bundle contains the Sentry SDK. It initialises only when a build-time reporting endpoint is configured. Session replay and performance tracing are disabled in code. Sentry sets no cookie or browser-storage identifier.
- Server-side status: backend error monitoring is configured separately and is described in the Privacy Notice and Subprocessor List rather than as browser storage.
- Change control: d5s will update this Notice, and obtain consent where required, before enabling session replay or frontend performance tracing.

If a future analytics or tracking tool requires consent, d5s will not load it until you make a choice, and will record that choice.

## 6. Third-party sites and integrations

Links, embedded content, authentication pages, payment checkout, and Customer-directed integrations may use technologies controlled by the relevant third party. Their notices apply on their domains. d5s does not load non-essential third-party scripts before consent where consent is required.

### Google Fonts

The application loads font stylesheets and font files directly from `fonts.googleapis.com` and `fonts.gstatic.com`. The browser sends IP address, user agent, request time, referrer where provided, and the requested font resource to Google. Google Fonts responses do not set cookies. d5s does not intentionally use Google Fonts for advertising or cross-site tracking. The applicable Google processing and transfer information is described in the Subprocessor List.

### Cloudflare Turnstile

The public request-access form uses Cloudflare Turnstile, an invisible bot-detection check, when it is enabled for the deployment. The form loads a script from `challenges.cloudflare.com`, and Cloudflare may process browser, device, network, interaction, and verification metadata to decide whether a submission is automated. The check runs only on that form, is strictly necessary to protect it from abuse, and sets no cookie or browser-storage identifier on the d5s domain. Any storage Cloudflare uses is on its own domain and is described in Cloudflare's privacy notice.

## 7. Managing technologies

No optional browser technology requiring consent is active, so d5s does not currently provide a cookie-consent control. If optional technology requiring consent is enabled later, d5s will provide an equally accessible way to accept, reject, and withdraw that consent.

You can also clear or block cookies and storage through browser settings, but blocking strictly necessary technology may prevent login or requested features from working.

## 8. Changes and contact

We update this inventory when technologies or purposes change and show the version/effective date. Questions: privacy@d5s.tech.