1. What cookies are
Cookies help a site remember a signed-in session, complete a security check, or understand aggregate traffic. LocalStorage is similar but is not a cookie; we use it only for theme (light/dark).
2. Types we use
- Essential / strictly necessary: login session and short-lived OAuth state. The product cannot sign you in without the session cookie.
- Analytics / performance: Vercel Web Analytics and Google Analytics tags. These stay off until Accept or a custom choice that allows analytics.
- Marketing / advertising: Meta Pixel, Google Ads conversion/remarketing tags, and TikTok Pixel when configured. These stay off until Accept or a custom choice that allows advertising.
3. Cookie inventory
| Name | Type | Purpose | Duration | How to opt out |
|---|---|---|---|---|
| session | Essential | Signed HTTP-only login session for nowstack.ai. Production cookies are scoped to .nowstack.ai so apex and www stay signed in. SameSite=None; Secure so the Chrome extension can call the API with credentials. | 7 days (renewed while you use the product) | Sign out, or clear site cookies. The authenticated product will not work without it. |
| ms_oauth_state | Essential | Short-lived nonce so a Microsoft mailbox connect callback belongs to this browser. | 10 minutes | Required only while connecting Microsoft. Expires on its own. |
| github_oauth_state | Essential | Short-lived CSRF state for GitHub OAuth. | 10 minutes | Required only while connecting GitHub. Expires on its own. |
| Stripe Checkout cookies | Essential (third-party) | When you start a trial we send you to Stripe Checkout to collect a payment method. Stripe sets its own cookies on stripe.com / checkout.stripe.com. | Set by Stripe | See Stripe’s cookie policy. You cannot complete a paid or card-required trial without Stripe. |
| _fbp, _fbc | Marketing | Meta Pixel browser identifiers used with Conversions API to attribute trial starts and paid subscriptions. | Up to 90 days | Reject on the cookie banner, or customize and leave marketing off. Sec-GPC keeps these off unless you later Accept. |
| _gcl_au, _gcl_aw, _ga, _ga_* | Marketing / Analytics | Google conversion linker and Analytics cookies set by tags you load through GTM after consent. | Up to 2 years (Analytics); ~90 days (Ads linker) | Reject on the cookie banner, or customize and leave analytics and ads off. Sec-GPC keeps these off unless you later Accept. |
| _ttp, ttclid | Marketing | TikTok pixel and click id when TikTok ads are configured. | Up to 13 months | Reject on the cookie banner, or customize and leave marketing off. Sec-GPC keeps these off unless you later Accept. |
4. Your choice
Essential cookies (the signed-in session and short-lived OAuth state) are set when you sign in or connect an account. Analytics and advertising cookies default to denied. The banner offers Accept, Reject, and Customize. Reject keeps essential cookies only. A Sec-GPC signal keeps analytics and advertising off unless you later Accept. Using the site is not agreement to those cookies.
5. Third-party cookies
Stripe sets cookies on Stripe’s domains when you enter Checkout to attach a payment method. Those cookies are Stripe’s, not ours. See Stripe’s cookie policy.
If you connect Google, Microsoft, or GitHub, those vendors set their own cookies on their login domains. Their policies apply to that step.
Vercel Web Analytics loads on this site. See Vercel’s privacy policy.
After you Accept, Meta, Google, and (when configured) TikTok may set cookies on their domains and receive hashed identifiers plus click ids so we can measure ad conversions. Server-side Meta Conversions API and TikTok Events API send the same trial-start and paid-subscription events even after you leave the site. See each vendor’s policy: Meta, Google, TikTok.
6. How to manage cookies
You can delete or block cookies in your browser. Instructions change by vendor:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Settings → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions
Blocking the session cookie signs you out and will break the authenticated product and the Chrome extension (the extension rides the same session cookie). Blocking Stripe cookies will prevent trial checkout.
Global Privacy Control (Sec-GPC) is honored: advertising and analytics stay off unless you later Accept. Do Not Track is not a separate switch. You can also block cookies in your browser (blocking the session cookie signs you out) or write via /contact for a deletion or do-not-share request. See also the Privacy Policy California section.
7. Updates
We will revise this page when we add, rename, or remove cookies. The “Last updated” date at the top is the version date. Continued use after an update is posted constitutes acceptance of the revised Cookie Policy.