Cookies

Last updated 15 October 2026

This page lists everything SnapBuddy stores on your device from the website, what each item is for, and how long it stays. The short version: the website sets two cookies, both of them strictly necessary, and neither is used to track you. A private test copy of the website, which needs a password to open, sets one more, also strictly necessary and also not used to track you. One more exists for our own staff and is never set for a customer. There are no advertising cookies, no analytics cookies and no third-party cookies of any kind. Anything optional is off until you switch it on, and you are asked before it runs, not after.

The two cookies

Both are first-party, which means they are set by SnapBuddy itself and are not readable by any other site. Both exist to make something work that you asked for, so neither is optional in any meaningful sense: turning them off is the same as being signed out.

• Your sign-in session. Named sb-<project>-auth-token, where <project> is an identifier for our database. It holds the token that keeps you signed in, and without it every page would ask you to sign in again. Because that token can be longer than a single cookie allows, your browser may show it split into numbered parts such as sb-<project>-auth-token.0 and .1. It lasts up to 400 days, and it is refreshed as you use the site. Signing out removes it. A short-lived companion, sb-<project>-auth-token-code-verifier, exists only during the seconds a sign-in is being completed and is deleted immediately afterwards. Set by Supabase, the service that holds accounts and data for SnapBuddy.
• Unlocking a password-protected share link. Named sb_share_unlock. When someone gives you a share link that has a password on it, this cookie records that you entered the password correctly, so you are not asked again on every view. It lasts 12 hours, and it is scoped to that one share link: it is not sent anywhere else on the site, and it says nothing about who you are.

Nothing else on this website writes a cookie, apart from one on our private test copy and one for our own staff, both described next. The desktop app and the browser extension set no cookies at all.

The private test copy

We keep a private copy of this website to try changes on before they reach you, and it asks for a password before it shows any page. Once you type that password correctly, the test copy sets one more cookie, named __Host-staging_gate. It holds a record, signed by our server so it cannot be faked, that the password was typed correctly at the test copy's address. It holds no password and nothing about who you are. It lasts 7 days, or until we change the password, and then the test copy asks for the password again. It is strictly necessary, because without it the test copy would ask on every page. It is first-party and tied to the one address that set it, so the real site never sets it and never receives it. If nobody has given you the password, you will never have this cookie.

Our own staff

One cookie is reserved for the people who work on SnapBuddy. When a staff member signs in to the staff console and enters a second-factor code there, the console sets a cookie named __Host-staff_elevation. It holds a record, signed by our server so it cannot be faked, that the code was entered at that address, by that staff account, in that browser session; it holds no password and nothing about any customer. It lets the console make changes for 20 minutes, and then the code has to be entered again. It is set only for staff accounts and only on the console's own pages, so you will never have this cookie. On our private test copy, which runs without the secure prefix, the same cookie is named staff_elevation.

Other things kept in your browser

The rules that cover cookies are really about storing information on your device, so two other kinds of storage belong on this page even though they are not cookies. Neither is sent to us with your requests the way a cookie is; both stay in your browser until you clear them.

Preferences, kept in local storage so the site looks the way you left it. These are settings, not identifiers: none of them says who you are, and none of them is sent to us. They are stored under the keys theme, preset, accent, sb.watermark and after_capture - your theme, your colour preset, your accent colour, whether captures carry a watermark, and what should happen after you take a capture.

Recordings in progress, kept in a browser database called snapbuddy-takes. While you are recording in the web app, the video is written to your browser in pieces so that a closed tab or a crash does not lose the take. Finished or abandoned pieces are cleared after seven days. This is your recording, held on your own machine, before you decide to keep it.

Third parties

None of them set anything on your device from this website today. Two services are built into SnapBuddy and are worth naming anyway, because the honest answer to "do you use analytics" is more specific than yes or no:

• Product analytics is wired into the signed-in app only, never onto a page you can read without an account, including this one. It is switched off, and it stores nothing in your browser while it is off. If that changes, this page changes with it, before it is switched on and not after.
• Error reporting runs on our servers only. It has no code in your browser and stores nothing on your device.

The privacy notice is the place where every company that receives your data is named and counted, including these. This page is only about what is stored on your device.

Your choices

The cookies described above are strictly necessary and are not offered as a choice, because there is no honest choice to offer: refusing them means being signed out, being unable to open a protected share link and, on the test copy, never getting past its password page; for our staff, it means being unable to change anything in the staff console. Your preferences are yours already. Analytics is the one thing here you can genuinely refuse, so it is the one thing you are asked about.

When analytics is available, a small panel appears with a switch for it, set to off. Nothing optional runs unless you turn it on, and closing the panel without choosing leaves it off: silence is a no, not a yes. Refusing takes one click and is not buried behind a second screen. Your answer is remembered in local storage under sb.consent - a record of what you chose, kept on your machine, never sent to us and not itself a cookie. You can change it whenever you like:

Clearing them

Every browser can show and delete cookies and site data for one site, usually under Settings, then Privacy, then cookies and site data. Clearing them for SnapBuddy signs you out, forgets your theme and colour choices, and discards any recording still in progress that you have not saved. On the test copy, you will also be asked for its password again. Nothing you have already uploaded to your workspace is affected.

You can also block cookies for this site entirely. Sign-in will not work if you do, because the session cookie is how being signed in is remembered. The test copy will not open past its password page either, because its cookie is how the password is remembered.

Changes

The date at the top of this page moves whenever a cookie or stored key is added, removed, or starts being used for something else, or whenever a third party begins storing anything on your device. It is not moved for wording. If you want to know what leaves your machine rather than what is kept on it, that is the privacy notice.