SaaSWish / Legal & trust
Cookie Policy
Version: 2026-11-11 · Effective date: [LEGAL_EFFECTIVE_DATE – to be provided by owner]
We use strictly necessary authentication/security cookies and user-requested preferences. We do not use analytics or advertising cookies or trackers, so no consent banner is used. We do not load Google Fonts or analytics scripts from third-party CDNs.
First-party cookies
| Name | Purpose and category | Duration |
|---|---|---|
god_token | Strictly necessary: signed login session. HttpOnly, SameSite=Lax, Secure over configured HTTPS. | 7 days; refreshed during use after 1 day. |
god_org | Strictly necessary: selects your active organization. HttpOnly, SameSite=Lax, Secure over configured HTTPS, including OIDC/SAML sign-in. | 30 days; cleared on logout and account deletion, or deletion of the selected organization. |
god_sso | Strictly necessary: OIDC sign-in state, nonce and PKCE verifier. HttpOnly, SameSite=Lax, Secure over configured HTTPS. | 10 minutes; cleared at sign-in callback. |
localStorage
These entries persist in your browser until removed, with no automatic expiry. They are not advertising identifiers.
| Key | Purpose and category |
|---|---|
god.signedIn | Strictly necessary: non-authoritative startup login hint; it does not authenticate you. |
god.draft.new | User-requested preference: saves a new-session prompt draft. |
god.draft.${id} | User-requested preference: saves the composer draft for each session ID. |
god.review.${session.id} | User-requested preference: saves line-review comments for a session. |
codebase.repo | User-requested preference: remembers your selected repository. |
spend-alert-dismissed | User-requested preference: remembers dismissal of a spending warning. |
sidebar | User-requested preference: remembers collapsed sidebar state. |
sidebar-collapsed | User-requested preference: remembers collapsed navigation groups. |
theme | User-requested preference: remembers your theme choice. |
sessionStorage
spend-alert-minimized is a user-requested preference recording a minimized spending alert for the browser session. It expires with that browser session rather than having a server-set expiry.
Your controls and other domains
You can remove cookies or site storage through browser settings. Blocking necessary cookies prevents sign-in or organization/SSO functions; clearing preferences resets choices and may lose drafts/review comments. Logout clears the login cookie, login hint and saved prompt/review drafts; other preferences may remain.
Stripe Checkout and your identity provider use their own cookies on their own domains, subject to their policies. Customer-connected previews or external content may also follow their providers' rules. Contact [LEGAL_PRIVACY_EMAIL – to be provided by owner] with questions; see Privacy for related processing and rights.