# Cookie Notice

Version: 2026-08-24

This Cookie Notice explains how d5s uses cookies and similar browser storage on its public websites and application. It supplements the Privacy Notice.

“Cookies” below includes HTTP cookies, local storage, session storage, and similar device technologies.

## 1. Consent

Strictly necessary technologies are used to provide security, authentication, requested features, and user-selected settings and do not rely on consent where applicable law permits.

We will request consent before using non-essential analytics, advertising, personalisation, or tracking technology where required. If we ask for consent, refusing will be as easy as accepting, and you will be able to withdraw it later without losing core access.

d5s does not use advertising, cross-site tracking, or session replay on its public websites or in the application. The public marketing site uses the cookieless, aggregated Vercel Web Analytics described below. d5s will update this Notice and obtain consent where required before enabling any technology that is not covered by this inventory.

## 2. Strictly necessary cookies

### d5s_refresh

- Host/path: `.d5s.tech` domain and `/api/v1` path.
- Type: secure, HTTP-only, SameSite=Lax refresh-token cookie.
- Purpose: maintain an authenticated web session and issue short-lived access tokens.
- Lifetime: up to 30 days, rotated during refresh and removed and revoked at logout.
- Provider: d5s.

### d5s_slack_link

- Host/path: API host and Slack identity-link path.
- Type: secure, HTTP-only, SameSite=Lax short-lived flow cookie.
- Purpose: securely complete a user-requested link between a Slack identity and a d5s account without placing the credential in a query string.
- Lifetime: 10 minutes.
- Provider: d5s.

### d5s_artifact_preview_token

- Host/path: API host and the relevant sandbox artifact-preview path.
- Type: secure, HTTP-only, SameSite=Lax.
- Purpose: authorise related assets loaded by a user-requested sandbox artifact preview.
- Lifetime: 5 minutes.
- Provider: d5s.

### d5s_artifact_version_preview_token

- Host/path: API host and the relevant versioned artifact-preview path.
- Type: secure, HTTP-only, SameSite=Lax.
- Purpose: authorise related assets loaded by a user-requested immutable artifact preview.
- Lifetime: 5 minutes.
- Provider: d5s.

### Authentication-provider cookies

WorkOS or an enabled enterprise identity provider may set strictly necessary cookies on its own domain during login, logout, multi-factor authentication, or identity administration. The WorkOS login flow uses:

- `__Host-state-<id>` — host-only, secure, HTTP-only, SameSite=Lax state cookie, lasting up to 24 hours;
- `__cf_bm` — Cloudflare bot-management cookie on the AuthKit domain, lasting about 30 minutes;
- `_cfuvid` — Cloudflare security cookie on the AuthKit domain, lasting for the browser session; and
- `initiate_login_context` — transient login context that is deleted immediately after use.

These provider-domain security cookies are separate from the optional d5s Turnstile integration described below.

## 3. Application local storage

The application uses local storage for authentication tokens and user-selected state. Local storage is available to scripts running on the application origin, so d5s protects the application with technical controls and does not intentionally expose these values to third-party marketing scripts.

### Authentication

- `access_token` — short-lived access token used for API requests.
- `access_token_expires_at` — expiry time used to refresh or clear the access token.
- Lifetime: until expiry/logout or manual browser-data removal.

### User preferences and workspace state

Examples include:

- `d5s:theme` — selected theme;
- `d5s:selected-model` and `d5s:selected-model-reasoning` — selected model and reasoning preference;
- `d5s.artifactPreview.width` — artifact panel width;
- `d5s:sidebar.recents.filter` — recent-conversation filter;
- `d5s:suggested-agents.dismissed` — dismissed suggestions;
- `d5s:project.setup.open` — project-setup state;
- `d5s:composer.web-search.enabled:{workspaceSlug}` — workspace-scoped web-search preference;
- `d5s:sidebar.*.open.v2` — sidebar section state;
- `d5s:greeting.*:{userId}` — user-scoped greeting state;
- `d5s.ask.dismissed.{conversationId}` — dismissed conversation prompts;
- `d5s.draft.edits.{conversationId}` — user-edited draft subjects and message bodies; and
- `d5s.suggestion.outcomes.{conversationId}` — conversation suggestion outcomes.

Purpose: remember choices, restore in-progress interface state, and avoid repeating dismissed prompts.
Lifetime: generally until changed, cleared by the relevant feature, or removed through browser controls. Logout removes the two authentication keys but does not generally clear preferences, conversation-scoped state, or draft edits.
Data: preference values, user/workspace/conversation/tool identifiers, and, for draft-edit keys, user-entered subject and message content.

### Debug preference

- `d5s:debug` — user-enabled diagnostic mode.
- Purpose: retain a local troubleshooting preference.
- Lifetime: until changed or browser data is removed.

## 4. Session storage

Session storage is cleared when the relevant browser tab/session ends.

Examples include:

- `d5s:stale-chunk-reload-at` — prevents repeated reload loops after a deployment;
- `d5s:start-rail[:workspaceId]` — workspace setup inputs, agent instructions, cadence, and selected communication destinations;
- `d5s:morning-brief-wizard[:workspaceId]` and `d5s:morning-brief-wizard:additional-draft:{workspaceId}` — schedule, voice, destination, and credential identifiers;
- `d5s.agent-wizard.{conversationId}.{toolCallId}` — agent instructions, persona, model, budget, timezone, connectors, and channel selections; and
- `d5s.billing.topUpIntent:{organizationId}` — top-up amount, prior balance, Stripe Checkout Session identifier, and settlement/dismissal state.

Logout does not generally clear current-tab session storage. It ends when the browser tab/session ends or when the user removes browser data.

## 5. Analytics and diagnostics

### Vercel Web Analytics

- Current status: active only on the public marketing site. It automatically records page views and records a `contact_submitted` event after the contact form succeeds. It is not active in the authenticated application shell.
- Purpose: understand aggregate traffic, referrers, popular pages, device categories, and whether visitors successfully contact d5s so we can evaluate and improve the marketing site.
- Data: event timestamp, page URL path, referrer where supplied, filtered query parameters, approximate geolocation, browser, operating system, device type, analytics-script version, and the `contact_submitted` event name. d5s does not attach the contact-form email address, message, form contents, or other custom properties to the event.
- Cookies/storage: none. Vercel Web Analytics does not set or read cookies or browser-storage identifiers. Vercel derives a daily visitor hash from the incoming request for aggregate unique-visitor measurement; the visitor session identifier is discarded after 24 hours and cannot track a visitor between websites or days.
- Retention and access: aggregate analytics remains available for the reporting window included in the d5s Vercel plan. Authorised d5s account members can access it through Vercel.
- Legal basis: d5s relies on its legitimate interest in measuring and improving its public business website. It is configured without cookies, cross-site tracking, advertising, session replay, or personal data in custom events.

### Sentry

- Current browser status: the application bundle contains the Sentry SDK. It initialises only when a build-time reporting endpoint is configured. Session replay and performance tracing are disabled in code. Sentry sets no cookie or browser-storage identifier.
- Server-side status: backend error monitoring is configured separately and is described in the Privacy Notice and Subprocessor List rather than as browser storage.
- Change control: d5s will update this Notice, and obtain consent where required, before enabling session replay or frontend performance tracing.

If a future analytics or tracking tool requires consent, d5s will not load it until you make a choice, and will record that choice.

## 6. Third-party sites and integrations

Links, embedded content, authentication pages, payment checkout, and Customer-directed integrations may use technologies controlled by the relevant third party. Their notices apply on their domains. d5s does not load non-essential third-party scripts before consent where consent is required.

### Google Fonts

The application loads font stylesheets and font files directly from `fonts.googleapis.com` and `fonts.gstatic.com`. The browser sends IP address, user agent, request time, referrer where provided, and the requested font resource to Google. Google Fonts responses do not set cookies. d5s does not intentionally use Google Fonts for advertising or cross-site tracking. The applicable Google processing and transfer information is described in the Subprocessor List.

### Cloudflare Turnstile

The public request-access form uses Cloudflare Turnstile, an invisible bot-detection check, when it is enabled for the deployment. The form loads a script from `challenges.cloudflare.com`, and Cloudflare may process browser, device, network, interaction, and verification metadata to decide whether a submission is automated. The check runs only on that form, is strictly necessary to protect it from abuse, and sets no cookie or browser-storage identifier on the d5s domain. Any storage Cloudflare uses is on its own domain and is described in Cloudflare's privacy notice.

## 7. Managing technologies

d5s does not currently provide a cookie-consent control because the active marketing-site analytics uses no cookies or browser storage and is configured for aggregate measurement only. If optional technology requiring consent is enabled later, d5s will provide an equally accessible way to accept, reject, and withdraw that consent.

You can also clear or block cookies and storage through browser settings, but blocking strictly necessary technology may prevent login or requested features from working.

## 8. Changes and contact

We update this inventory when technologies or purposes change and show the version/effective date. Questions: privacy@d5s.tech.