Every file we set, every reason we set it, and every way you can turn them off. No tricks, no buried defaults.
Cookies are tiny pieces of text a website asks your browser to store, then reads back on later visits. They power things like keeping you logged in, remembering your dark-mode preference, and counting how many people visit our pricing page (in aggregate, with no names attached).
This policy covers cookies and similar technologies — local storage, session storage, pixels, and IndexedDB — collectively referred to as “cookies” for the rest of this page.
We classify cookies in line with the EDPB guidelines and ePrivacy Directive. Strictly necessary cookies don’t require consent (they’re required to deliver a service you explicitly requested). Everything else does.
Required for core functionality. You can’t opt out without breaking the app. Includes session cookies, CSRF tokens, and the cookie that remembers your consent choices.
Improve usability without being essential — your saved theme, your preferred locale.
Help us understand which features matter. Self-hosted via PostHog on our infrastructure. We disable session recording, capture no form inputs, and respect Do Not Track + Global Privacy Control.
We don’t use any. No retargeting pixels, no ad-network fingerprints. If that ever changes, we’ll announce it 30 days in advance and require explicit consent.
The list below covers cookies set by Notealy directly. We update this whenever it changes. Last verified on the date at the top of this page.
| Name | Purpose | Lifetime |
|---|---|---|
crm_token | Authentication. Stores your session JWT after login. | Session + 7 days |
notealy.csrf | CSRF protection on form submissions. | Session |
notealy.consent | Records your cookie preferences so we don’t re-prompt. | 12 months |
__cf_bm | Cloudflare bot management (sub-processor). | 30 minutes |
| Name | Purpose | Lifetime |
|---|---|---|
NEXT_LOCALE | Remembers your language (en, pt-BR). | 12 months |
notealy.theme | Stores your dark/light theme choice. | 12 months |
notealy.lastOrg | Last workspace you accessed, for redirect on login. | 6 months |
| Name | Purpose | Lifetime |
|---|---|---|
ph_* | PostHog (self-hosted). Anonymous event analytics. No PII, no session recording. | 12 months |
We use browser storage to cache UI state — open tabs, sidebar width, scroll positions. Strictly necessary. Cleared when you sign out or clear site data in your browser.
Used for offline-capable views (the inbox keeps recent threads locally so it loads instantly). You can wipe it via your browser’s site settings.
We don’t use them on the marketing site. Inside the app, we use a single 1x1 pixel for transactional email open tracking — and only if you’ve enabled per-message tracking in your campaign settings. End-recipients can disable image loading to opt out.
When you first visit the app or marketing site from a region that requires it (EU, UK, Brazil), you see a consent banner. You can revisit your choices at any time:
Cookie preferencesSettings → Privacy → CookiesYou can block or delete cookies through your browser settings. Direct links to instructions:
Blocking strictly-necessary cookies will prevent login. Blocking functional cookies will reset your preferences on every visit. Blocking analytics costs you nothing.
Whenever we add, remove, or repurpose a cookie. Changes that require fresh consent (a new analytics tool, for example) prompt you again before they take effect. Other changes are noted in the version stamp at the top of this page.
A revision history is kept at notealy.com/cookies/history.
Email dpo@notealy.com for anything cookie- or tracking-related. Privacy in general is covered in our Privacy Policy; security in our Security page.
You also have the right to lodge a complaint with your local supervisory authority (ANPD in Brazil, your DPA in the EU) if you believe we’re mishandling cookies. We’d rather you tell us first — we move fast on this stuff.
Legal matters deserve real answers. Email our team and we’ll get back within two business days — no canned templates.