Cookies & browser storage
What we store, what we measure, and how you control it. Last updated: 24 October 2026.
Your choice
Optional website analytics is off until you accept it. Accept analytics and Reject analytics are equally available. Open Privacy choices at the bottom of any page to change your selection. Closing the panel without a choice leaves analytics off. We honour Do Not Track and Global Privacy Control by keeping analytics off.
Essential authentication cookies
inboxit_session is an opaque HttpOnly, SameSite=Lax session identifier, Secure on HTTPS. Sessions with refresh credentials last up to 30 days; non-refresh sessions are capped at one hour or the shorter token lifetime. Signing out clears the cookie. inboxit_login is a ten-minute HttpOnly, SameSite=Lax login-state cookie used during Google/Madnion sign-in and cleared after the callback. These cookies are not controlled by the optional analytics choice.
Privacy preference
inboxit-consent-v1 in local storage records the consent version, analytics choice and timestamp. It is valid for 180 days; after expiry or a version change analytics stays off until a new choice. Browser storage has no automatic expiry, so the stored record may remain until overwritten or cleared. If storage is unavailable, analytics remains off and we cannot remember a choice across visits. Choices apply to this browser and origin; different origins have separate preferences.
Requested dashboard preferences
inboxit-sidebar-collapsed remembers the sidebar layout. inboxit:onboarding:v1:<workspace> remembers completed onboarding steps. DNS copy-status storage remembers copied DNS fields so you can track setup. These are functional settings, not visitor tracking, and remain until reset or browser storage is cleared. DNS records may contain your domain and public verification material; do not share browser storage exports.
Analytics and advertising
We use first-party aggregate page-view and load-time measurement, gated by your analytics choice. With the same choice, tutorial analytics measures plays, active watch time and completions. A random playback ID exists only for the open page session and is not linked to an account. Reports cover the last 90 days and older playback records are removed when new activity is recorded; no video-viewing identifier is stored in browser storage. No analytics identifier cookie, advertising pixel, session replay or fingerprinting code was found in the reviewed first-party source. Accepting analytics does not authorise future advertising tools. Further tracking would require another review and appropriate controls.
External services
Fonts are served from InboxIt. Google/Madnion sign-in and Supabase process authentication requests. The reviewed frontend does not initialise the Supabase browser SDK or store its authentication tokens in local storage; our backend handles authentication and sets the InboxIt session cookie. Google sign-in redirects through Madnion. Storage on those provider domains depends on their own sessions and preferences and has not been measured in a fresh authenticated browser session. Their cookies are not controlled or cleared by InboxIt’s analytics preference. Clicking Facebook or YouTube opens that provider’s site; we do not embed their widgets here.
Withdrawal and deletion
Choose Reject analytics to stop future optional measurements. Already recorded page/day totals cannot be attributed back to your browser and are not individually removed when you withdraw. Clearing site storage removes preferences and may sign you out; blocking authentication cookies can prevent sign-in. Your browser’s settings can clear both cookies and local storage.
Contact
For storage or privacy questions, email hello@inboxit.wtf. This inventory was updated on 24 October 2026.