Cookie Policy
English is the governing language
This document is published in English. The English text is authoritative and governs in the event of any conflict or question of interpretation.
Controller and Privacy Policy
Truestamp is the controller of any personal data processed through cookies and similar technologies described on this page. For our full data-handling practices and your rights under the General Data Protection Regulation (GDPR), UK GDPR, California Consumer Privacy Act (CCPA/CPRA), and other data protection laws, see our Privacy Policy.
What Are Cookies and Similar Technologies
Cookies are small text files that a website stores on your device. Similar technologies include browser local storage, session storage, and IndexedDB, which also persist information on your device. This policy covers all of these technologies collectively, referred to below as "storage." Under the ePrivacy Directive (Article 5(3)), the UK Privacy and Electronic Communications Regulations (PECR), and equivalent laws, all such storage is subject to the same rules regardless of technology.
Our Approach
Truestamp uses storage for three purposes: (1) functions that are strictly necessary to provide the Service you request, (2) preferences that you explicitly set yourself (such as your UI theme and language), and (3) the embedded UserJot feedback widget, which lets you submit feedback to us and view our public roadmap and changelog. We do not use cookies or other storage for advertising, cross-site tracking, behavioral profiling, or general-purpose website analytics.
We do not display a cookie consent banner. The storage we set is limited to the strictly necessary functions, user-set preferences, and the feedback widget described above; none of it is used for behavioral profiling or to track you across other websites. If we introduce additional non-essential third-party storage or analytics in the future, we will update this policy before deployment, disclose what is collected and by whom, and request your consent where required by law.
Storage Inventory
The following tables list every item of storage the Service places on your device in production, what it contains, how long it persists, and the legal basis for using it without prior consent.
First-Party Cookies
| Name | Purpose | Duration | Basis |
|---|---|---|---|
_truestamp_key |
Signed session. Carries the cross-site request forgery (CSRF) token that protects form submissions; your language preference (negotiated from your browser's Accept-Language header, or a language you explicitly picked while signed out); for signed-out visitors, your chosen UI theme and a randomly generated chat guest identifier that keeps your AI assistant conversation and its daily message allowance separate from other visitors; and, when you sign in, your session identity (your user reference, your active team, and the path to return you to after signing in). Signed-in users' theme preference is stored on the server on their user record, not in this cookie. The cookie is signed to prevent tampering; HttpOnly and SameSite=Lax; Secure in production. | Session (deleted when you close the browser or log out) | Strictly necessary: CSRF protection is essential for security, session identity is required to keep you signed in, the guest identifier is required to deliver and rate-limit the chat feature, localization fulfills the language indicated by your browser or chosen by you, and the theme value reflects a preference you explicitly set |
remember_me |
Set only if you tick "Remember me" when signing in. Holds a signed token that signs you back in on a later visit without re-entering credentials. HttpOnly and SameSite=Lax; Secure in production. Deleted when you sign out, and the underlying token is revoked on our servers at the same time. | 30 days | Strictly necessary to provide the persistent sign-in you explicitly request; never set unless you ask for it |
__phoenix_flash__ |
Set briefly by the Phoenix web framework during certain full-page redirects to carry a one-time status message (for example "Signed out successfully") across the redirect. Read and deleted by the server on the next request. | At most 60 seconds | Strictly necessary to display the status message you triggered |
One additional diagnostics cookie (request_logger) exists solely on internal administration dashboards and can only be enabled by Truestamp staff accounts for their own browser; ordinary visitors never receive it.
Browser Storage (localStorage and sessionStorage)
| Key | Type | Purpose | Duration | Basis |
|---|---|---|---|---|
<page-path>-consecutive-reloads |
localStorage | Integer counter managed by the Phoenix LiveView framework, keyed by the current page URL path. Incremented each time the framework has to fall back to a full-page reload to recover a broken connection (server restart, network drop, or crashed view). After a threshold is reached the framework increases the delay between reloads to avoid a tight loop that would hammer the server or freeze your browser. The counter does not identify you and contains only a number; it is deleted automatically on the first successful reconnection. | Cleared automatically on a successful connection | Strictly necessary for the reliability of the Service |
phx:nav-history-position |
sessionStorage | Position counter written by the Phoenix LiveView framework on each in-app navigation so that scroll position and page state can be restored when you use your browser's back and forward buttons. Contains only a number and does not identify you. | Cleared automatically when the browser tab is closed | Strictly necessary for in-app navigation to work correctly |
ts:chat:open |
localStorage | Remembers whether you left the AI assistant sidebar open or closed, so its toggle button renders in the right state on your next page view. Contains a single flag value and no identifier. | Persistent until you clear browser storage | Reflects an interface preference you explicitly set |
Beyond the items above, the Service does not use IndexedDB or any other client-side storage technology. If you explicitly enable the web framework's debugging helpers from your browser's developer console, the framework stores your chosen debug settings in sessionStorage; these keys are never set during normal use. Storage set by the embedded UserJot feedback widget is listed under Embedded Third-Party Tools below. Your theme preference is held on the server: stored on your user record when you are signed in, or in the signed session cookie while signed out. The open or closed state of collapsible sidebar menus is held only in server-side memory for the lifetime of the page and is never persisted.
Embedded Third-Party Tools
We embed one third-party tool: the UserJot feedback widget, operated by LogSnag LLC ("UserJot"). The widget collects product feedback, surfaces our public roadmap, and shows our changelog directly inside the application. UserJot is listed in the Subprocessors table on our Privacy Policy and Data Processing Addendum.
The UserJot SDK is loaded by your browser from the third-party origin https://cdn.userjot.com/sdk/v2/uj.js. This is the only third-party JavaScript the Service embeds on ordinary application pages (the developer documentation pages described below load their own viewer libraries from public CDNs). When you are signed in, we send your user ID, email address, given name, family name, and current plan tier to UserJot so the widget can attribute your feedback to your account; the widget is also told your current interface language and theme so it can match the application's appearance. When you submit feedback through the widget, the content of that feedback is sent to UserJot's hosted feedback boards. UserJot may also receive your IP address and user-agent through the SDK's network requests.
The UserJot widget stores the following items in localStorage on this site's origin so it can identify you across page loads, dim the changelog badge once you have read an update, and avoid re-syncing identity data unnecessarily. None of these items are cookies; the widget does not set any cookies on your browser:
| Key | Type | Purpose | Duration |
|---|---|---|---|
uj_userId |
localStorage | Encoded copy of the identity payload UserJot received for you (your ID and email), used by the widget to recognize you across page loads | Persistent until you sign out or clear browser storage |
uj_identifyHash |
localStorage | Hash of the most recent identity payload, so the widget can detect when your details change and re-sync | Persistent until you sign out or clear browser storage |
uj_projectId |
localStorage | Truestamp's UserJot project identifier, a constant value used by the SDK to scope its API calls | Persistent until you clear browser storage |
uj_lastSeenUpdate |
localStorage | ID of the most recent changelog entry you have viewed, so the widget knows when to dim or hide the "new updates" indicator | Persistent until you clear browser storage |
Storage set inside the widget itself (for example, an unsent draft message) is governed by UserJot's privacy policy, not this policy. To remove all UserJot-set browser storage, clear site data for this site in your browser settings or sign out.
Developer Documentation Pages
Three developer-facing documentation pages load their interactive viewer applications from public content delivery networks rather than from our own domain: the Swagger UI API explorer (assets from cdnjs.cloudflare.com), the ReDoc API reference (its viewer from cdn.jsdelivr.net and its fonts from fonts.googleapis.com), and the GraphQL playground (assets from cdn.jsdelivr.net). When your browser fetches these assets, it transmits your IP address and user-agent to the CDN operator, as with any web request. These CDNs serve static files and do not set cookies through these requests. No page outside these three loads application code from a remote origin, apart from the UserJot SDK described above.
Network Security (Cloudflare)
The Service sits behind Cloudflare, which provides DNS, content delivery, and DDoS protection. Cloudflare does not set cookies on ordinary requests to the Service: we do not use its cookie-based session affinity, and normal browsing sets no Cloudflare cookie. If Cloudflare's protections are engaged (for example during an attack, or if a request triggers a security challenge), Cloudflare may set strictly necessary security cookies of its own (such as __cf_bm or cf_clearance) to distinguish legitimate visitors from automated traffic. Any such cookie is set by Cloudflare to protect the Service and is not used by us to identify you.
Map Data from OpenStreetMap
Some pages include geographic maps rendered with map tile images loaded from the domain tile.openstreetmap.org, which is operated by the OpenStreetMap Foundation (a United Kingdom charity). When your browser loads these tiles, it sends your IP address and user-agent string to OpenStreetMap, which may log them in accordance with the OpenStreetMap Foundation Privacy Policy. OpenStreetMap does not set cookies on your browser, and we do not share any additional information with them.
We rely on map tiles under our legitimate interest in providing a functional map visualization. If you do not wish to share this information with OpenStreetMap, avoid pages that display maps, or block requests to tile.openstreetmap.org in your browser.
What We Do Not Do
- We do not use advertising cookies, remarketing pixels, or advertising identifiers
- We do not use cross-site tracking, behavioral profiling, or third-party analytics
- We do not use browser fingerprinting, canvas fingerprinting, ETag tracking, or similar passive identification techniques
- We do not load marketing tags or advertising scripts from remote origins. Fonts and application code on application pages are bundled and served from our own domain. The exceptions are the embedded UserJot feedback widget and the three developer documentation pages disclosed above
- We do not sell or share your personal information within the meaning of the California Consumer Privacy Act (CCPA/CPRA) or equivalent laws
Do Not Track and Global Privacy Control
Because we do not track users across websites, do not sell or share personal information, and do not use storage for behavioral profiling, the Service behaves the same way regardless of whether your browser sends a Do Not Track (DNT) header or a Global Privacy Control (GPC) signal. We honor these signals by default: there is nothing to opt out of. If we introduce technologies in the future for which such signals are relevant, we will update this policy and honor valid GPC signals as required by California, Colorado, Connecticut, and other applicable laws.
Managing Storage in Your Browser
You can view, restrict, or delete cookies and browser storage at any time through your browser's settings. Most browsers group these controls under "Privacy," "Site Settings," or "Cookies and site data." Disabling storage used by Truestamp may affect the Service, including:
- If you block cookies: inability to log in or maintain a session, failed form submissions due to missing CSRF protection, loss of AI assistant conversation continuity while signed out, and (for signed-out visitors only) loss of your theme preference
- If you block localStorage or sessionStorage: reduced resilience during connection outages, imperfect scroll and page-state restoration when using the back and forward buttons, and loss of the remembered open or closed state of the AI assistant sidebar
Browser Settings
Search for "cookies," "site data," or "privacy" in your browser's help section for specific instructions on viewing, blocking, or deleting stored information.
Updates to This Policy
We may update this Cookie Policy from time to time. If we make material changes, we will provide at least 30 days' advance notice by posting the updated policy with a new revision date and, where practicable, notifying registered users. If we introduce any storage or third-party technology for which consent is required, we will not begin using it until we have updated this policy and obtained consent where required by applicable law. If you do not agree with a revised policy, you may close your account or stop using the Service before it takes effect.
Language
This Cookie Policy is published in English. The English text is the authoritative version and governs in the event of any conflict or question of interpretation. Translated content elsewhere on this site is provided for convenience and does not modify this policy.
Contact Us
If you have questions about this Cookie Policy or our use of storage, please contact us: