Cookies and storage
Updated October 26, 2026
Cookies are one form of browser storage. This inventory also explains local storage, in-memory event buffers and third-party boundaries. Necessary service records and optional behavioral analytics serve different purposes.
Read the Privacy Policy for processing purposes, AI features, retention and your rights.
Your controls
Choose Cookie settings in the website footer or product Privacy settings. Accept grants analytics and eligible masked replay; settings lets you choose either purpose separately. Proposed settings take effect only after you explicitly accept or save them. Closing settings does not grant permission. Decline preserves access to the requested service. Global Privacy Control keeps optional analytics and replay restricted in that browser. Ignoring the notice or reading this page does not grant permission.
Privacy links and this inventory remain available without JavaScript. Optional collection requires JavaScript and a validated choice; disabling it does not grant permission. Clearing storage can remove a saved choice and return the browser to an unanswered, restricted state.
| Name / technology | Purpose and data | Category / provider | Surface and scope | Lifetime | When it starts and stops |
|---|---|---|---|---|---|
| __Host-by_assistant | Authorize only the requested public AI guide, independently of product authentication and optional tracking. | Necessary · Backyard / first party | Marketing host only; Secure, HttpOnly, SameSite=Strict, Path=/. Separate proof stays in document memory. | 30 minutes from opening the panel; not created on an unopened page. | New chat replaces this guest conversation. Blocking the cookie prevents model requests; public signup, support and policy links remain usable. |
| Ask Backyard display and draft (memory) | Show the current public conversation without a server transcript archive or saved browser history. | Requested service · Backyard / first party | Current document memory; excluded from replay and optional event properties. | Until New chat, document reload or closing the document. Closing the panel preserves the draft in memory. | New chat removes local display history and requests cancellation. Provider records and necessary aggregate cost/security metadata are separate. |
| session-id / admin-session-id | Authenticate a requested product or administration session; no optional analytics identity. | Necessary · Backyard / first party | Product/API or administration boundary; the service’s authentication configuration determines scope. | Product session default 24 hours; administration default 1 hour. Sign-out or expiry ends the session. | Starts on sign-in. Sign out to end your session; blocking this cookie can prevent sign-in. |
| csrftoken | Protect requests against cross-site request forgery. | Necessary · Backyard / first party | Application/API request boundary, under the authentication configuration. | Follows the service’s CSRF protection configuration and browser expiry. | Set when request protection is needed; it does not grant analytics permission. |
| __Host-by_privacy | Opaque reference to server-held privacy choices and their current revision; never used as a behavioral identity. | Necessary · Backyard / first party | Host-only cookie; Secure, HttpOnly, SameSite=Lax, Path=/. Separate site origins hold separate choices. | 180 days from an explicit choice, unless revoked or a material revision invalidates it sooner. | Saved when you make a privacy choice. Cookie settings changes or withdraws optional permission. |
| __Host-by_privacy_csrf | Protect privacy-choice, event and rights requests using a request proof; no behavioral identity. | Necessary · Backyard / first party | Host-only Secure, HttpOnly, SameSite=Lax cookie at Path=/; the first-party consent response supplies the matching request proof. | Browser session; renewed by the privacy state endpoint as needed. | Set when the privacy state is resolved. Blocking it prevents optional grants and authorized privacy mutations. |
| backyard:privacy-restriction | Remember a local restriction even when the consent service is unavailable. It cannot grant optional collection. | Necessary · Backyard / first party | Browser localStorage on the current origin. It contains restriction state and expiry, not a behavioral history. | 180 days from explicit restriction; expires without being extended by ordinary visits. | Saved on a restrictive choice. A later explicit acknowledged choice can replace it. Blocked storage leaves optional collection restricted. |
| Product event buffer (memory) | Batch only approved events after valid analytics permission; no offline activity reconstruction. | Optional analytics · Backyard / first-party collection; PostHog reporting adapter | Current document memory; no browser analytics cookie or persisted offline event queue. | At most 60 seconds; up to 20 events and 32 KiB per batch, at most 4 KiB per event. | Starts after permission is acknowledged. Withdrawal drops buffered events without a final optional batch. |
| Masked replay session and buffer (memory) | Hold a separately authorized recording handle and sanitized structural interaction events on approved marketing pages. | Optional replay · Backyard / first-party admission and collection; PostHog reporting adapter | Current recording window in document memory after explicit permission and sampled server admission. No offline replay storage or customer-content surface recording. | Recording windows are limited to 10 minutes; unsent browser buffers are dropped on withdrawal or excluded navigation. Retained recordings have a separate 14-day target schedule. | Accept or an explicit settings save can permit replay; server sampling and eligible routes further restrict it. Turning replay off stops recording without a final optional batch. |
| theme, userLanguage, *_sidebar_collapsed | Remember requested theme, language and navigation presentation choices. | Functional service storage · Backyard / first party | Product-origin localStorage; setting values rather than behavioral history. | Until changed, reset or cleared in the browser; no automatic time expiry in these preference keys. | Used for interface preferences; changing a setting updates it. Clearing browser data removes local settings. |
| fm_viewMode, fm_sortField, fm_sortOrder, fm_recentFiles, fm_favorites, fm_trashMeta | Files interface preferences, recent/favorite references and local trash metadata for the requested file service. | Functional service storage · Backyard / first party | Product-origin localStorage. File references can identify customer work and are not product analytics properties. | Until feature cleanup, reset or browser clearing; these keys do not have a general automatic expiry. | Used in the Files interface. Optional analytics withdrawal does not delete customer working state. |
| novataxai_files / file_path (IndexedDB) | Cache file listings and permissions for requested file navigation, scoped to account, session epoch, workspace, connection and path. | Functional service cache · Backyard / first party | Product-origin IndexedDB, with memory fallback when unavailable. | Cached entries older than 30 minutes are not used; a refresh may occur after 5 minutes. Read expiry does not guarantee immediate physical erasure. | Populated by file navigation and updated or cleared by the feature. Browser storage controls can clear the database. |
| __NOVATAX_ROUTE_NAVIGATION_INTENT__ | Temporarily remember a requested internal navigation and timing for route-readiness measurement. | Minimized service diagnostics · Backyard / first party | Product-origin sessionStorage; full navigation text is not forwarded as a product event. | Consumed on the next matching navigation; otherwise browser tab/session lifetime. | Written for an internal navigation measurement and removed when consumed. Clearing session storage removes it. |
| novatax.workbook-runtime-prefetch-build | Avoid repeatedly prefetching the same immutable workbook editor build assets. | Functional service storage · Backyard / first party | Product-origin sessionStorage; contains an editor build identifier. | Browser tab/session lifetime, replaced when a different build is prefetched. | Set after editor asset prefetch completes; normal editor loading still works when storage is unavailable. |
| baserow-public-auth:<share> | Retain the access token required to open a protected public database share. | Necessary access storage · Backyard / first party | The share’s browser origin, in localStorage, scoped by the share key. This is authentication material, not an analytics identifier. | Until cleared or replaced locally; validity is also controlled by the share’s access policy. | Starts after successful share authentication. Share access controls or browser clearing can end access. |
Analytics, diagnostics and replay
Optional events use a first-party endpoint with server consent and schema checks before the selected PostHog reporting adapter. Privacy receipt references stay in the first-party control plane. We do not install advertising pixels or use a general browser analytics SDK to automatically collect your clicks, page text or full URLs.
Separately admitted replay is limited to approved safe pages and uses its own permission and recording controls. It is excluded from customer documents, workbooks, databases, chat, billing, authentication and third-party frames. Necessary minimized performance, security and service diagnostics have separate controls and can remain available after optional tracking is declined.
Other service boundaries
A Cal.com booking calendar or an external booking page processes information under that service’s notice when you choose to load or visit it. Payment, authentication, connected-service and customer-hosted pages can have their own necessary storage. Our platform preference does not authorize third-party advertising or customer-site analytics.
Cloudflare provides edge and security services. Browser measurement and necessary security are different purposes; optional browser measurement must follow the relevant choice. Network requests can occur without cookies, so an empty cookie list does not establish the absence of collection.
For a question about a particular deployment, provider or storage entry, use our contact page. Do not include passwords, tokens, tax records or other sensitive content in an ordinary email.