Overview
This Cookie Policy explains how Appsanic uses cookies and similar client-side storage when you visit appsanic.com and use the Appsanic service. Appsanic is operated by Encode Digital Software Solutions Pty Ltd (ACN 690 774 719), a company registered in New South Wales, Australia (“Appsanic”, “we”, “us”).
This policy should be read together with our Privacy Policy, which describes how we handle personal information under the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs), and our Terms of Service. It is written for both everyday users and for procurement teams and regulators who need a precise account of what we store on your device.
The short version.We use a small number of strictly necessary cookies to keep you logged in, protect requests against forgery, record your consent choice, and secure connector sign-in flows. We store some interface preferences in your browser’s local storage. We do not use any advertising, analytics, or cross-site tracking cookies, and we set no third-party marketing cookies.
What cookies and local storage are
Cookies are small text files that a website asks your browser to store on your device. On each subsequent request to the same site, the browser sends the cookie back, which lets the site recognise your session, keep you signed in, or remember a choice you made. Cookies have a name, a value, an expiry, and security attributes (for example whether they are restricted to encrypted connections or readable by JavaScript).
Appsanic also uses two browser storage mechanisms that are related to, but technically distinct from, cookies:
localStoragekeeps small values on your device until you or the browser clear them. Unlike a cookie, the contents are never automatically sent to a server; they stay on your device and are read only by the Appsanic interface in your browser.sessionStoragebehaves the same way but is cleared when you close the browser tab. We use it for short-lived hand-off values within a single session.
Throughout this policy we use “cookies” broadly to include this related storage where relevant, and we identify which mechanism applies in each case.
Our approach
We take a data-minimising approach. We use the smallest set of cookies and stored values needed to run the service securely, and we do not load advertising or analytics technology. In practice this means:
- Strictly necessary by default. The only cookies set without your active choice are those required to log you in, keep your session secure, record your consent, and protect connector sign-in flows.
- Consent for anything non-essential. Functional storage of your interface preferences is gated behind your consent choice. If you decline, the service still works; it simply will not remember those preferences between sessions.
- No tracking. We do not profile you, build advertising audiences, or share device identifiers with advertising networks. There is nothing to opt out of in that category because we do not operate it.
This reflects our obligations under the APPs (collect only what is reasonably necessary; be open about handling) and the general principle in the EU and UK ePrivacy regime that consent is required for any storage that is not strictly necessary to provide a service the user has requested.
Categories we use
We group what we store into three categories. Today, Appsanic only uses the first two; the third is listed for completeness.
| Category | Purpose | Consent |
|---|---|---|
| Strictly necessary | Log-in and session state, CSRF protection, recording your consent choice, and securing connector sign-in (OAuth) flows. Without these the service cannot function securely. | Not required. These are exempt from consent because they are essential to deliver a service you have requested. Blocking them will break log-in and checkout. |
| Functional | Remembering interface preferences (for example theme, selected AI model, panel widths, sidebar and editor state). Stored in your browser’s local storage, not in cookies, and never sent to our servers. | Gated by your consent. If you decline, the service still works with default preferences each session. |
| Advertising / tracking | None. We do not use third-party advertising, analytics, or cross-site tracking cookies of any kind. | Not applicable. |
How consent works
Because strictly necessary storage does not require consent, and we run no advertising or analytics, the consent mechanism governs a narrow set of functional preferences. We record your choice in a single cookie so we do not have to ask again on every visit.
| Cookie | What it does | Lifespan and attributes |
|---|---|---|
appsanic-consent | Records your consent choice (whether functional storage is allowed in addition to strictly necessary storage). Functional preferences are only persisted once this records consent. | 365 days. Secure in production, SameSite=Lax. |
You can change your mind at any time. Updating your choice rewrites the appsanic-consent cookie; withdrawing consent stops new functional values being written and you can clear existing ones through your browser controls (see Managing cookies). Withdrawing consent does not affect strictly necessary cookies, which remain in place so the service keeps working.
Specific cookies we set
The exact cookies present depend on the page, your authentication state, and whether you are part-way through connecting a third-party service. The table below lists every cookie Appsanic itself sets. We do not set cookies for advertising or analytics.
| Name | Category | Purpose | Lifespan and attributes |
|---|---|---|---|
sb-<project-ref>-auth-token | Strictly necessary | Supabase authentication token, issued after you log in, used to keep you signed in. May be split across chunked cookies (for example .0, .1, .2) when the value is large. | Up to about 1 year, refreshed on use. HttpOnly (not readable by JavaScript), Secure in production, SameSite=Lax. |
appsanic-csrf | Strictly necessary | Cross-site request forgery (CSRF) protection using a double-submit pattern. On state-changing requests the browser sends this cookie and our interface echoes the same value in a request header; the server only proceeds if the two match. | 7 days. Intentionally not HttpOnly so JavaScript can read it and place it in the request header. Secure in production, SameSite=Lax, Path=/. |
appsanic-consent | Strictly necessary | Records your cookie-consent choice and gates functional storage. See How consent works. | 365 days. Secure in production, SameSite=Lax. |
sb_oauth_state, sb_oauth_user, sb_oauth_account, sb_picker, st_oauth_* (Stripe), gh_oauth_* (GitHub) | Strictly necessary | Short-lived cookies set only while you are connecting a third-party service through an OAuth flow. They bind the round trip to your session to prevent CSRF during sign-in. sb_picker is encrypted and briefly holds tokens while you choose which Supabase project to connect. | About 10 minutes (they expire as soon as the flow completes). HttpOnly, Secure in production, SameSite=Lax. |
No ui-preferences cookie.Some earlier material referred to a cookie of this name. It does not exist. Interface preferences are stored in your browser’s local storage, not in a cookie, and are never transmitted to our servers (see Local storage (not cookies)).
Local storage (not cookies)
Appsanic stores a number of interface preferences in your browser’s localStorage rather than in cookies. These values are device-local: they live in your browser, are read only by the Appsanic interface on your device, and are not sent to our servers. Functional items are written only where your consent allows. Examples include:
- Theme (
appsanic.build-theme) - light or dark appearance. - AI model choice (
appsanic.model) and the thinking toggles for the build agent. - Layout preferences - agent-panel width, dashboard sidebar collapse state, and per-project code-editor state.
- Local UI state- rate-limit countdown timers and “builds seen” markers, so the interface does not repeat notices unnecessarily.
We also use sessionStorage for short-lived hand-off values within a single browsing session: a pending build or prompt being carried from one screen to the next, and a one-time flag used to recover the in-browser preview after a navigation (a content-security self-heal step). These clear when you close the tab.
You can clear local and session storage from your browser’s developer tools or site-data controls. Doing so resets your interface preferences but does not log you out on its own.
Third-party cookies
We do not set any third-party advertising, analytics, or cross-site tracking cookies. We do not embed advertising pixels or social-media trackers.
When you choose to connect an external service (for example Supabase, Stripe, or GitHub) through an OAuth flow, that provider may set its own cookies on its own domain during sign-in, governed by that provider’s policies. The short-lived cookies described in Specific cookies we set are set by us on our domain to secure that flow; they are not third-party tracking cookies. For the full list of organisations that process data on our behalf, see our Sub-processors page.
If this ever changes (for example if we introduce privacy-respecting analytics), we will update this policy and, where the law requires, obtain your consent before any non-essential cookie is set on your device.
Managing cookies
You can review, restrict, or delete cookies through your browser settings. You can also clear the interface preferences described above by clearing your browser’s site data. Help articles for the major browsers:
Please note. Blocking or deleting strictly necessary cookies will prevent you from logging in, completing checkout, or connecting third-party services. These cookies are essential to provide the service, so we cannot offer a working session without them.
No advertising, analytics or cross-site tracking
We want to be unambiguous: the Appsanic platform contains no advertising cookies, no analytics or product-telemetry cookies, and no cross-site tracking. We do not run third-party analytics suites and we do not embed advertising or social tracking technology. The only data we hold about your use of the service is what we describe in our Privacy Policy (for example account, project, and billing records), held under the Australian Privacy Principles, and we do not use it to build advertising profiles or sell it.
Changes to this policy
We may update this Cookie Policy from time to time to reflect changes in the cookies we use or in legal requirements. When we do, we will revise the “last updated” date at the top of this page. If we introduce cookies or storage that we do not use today (for example analytics or advertising), we will update this page and, where required by law, obtain your consent before those cookies are set.
Contact
For questions about this Cookie Policy or our handling of cookies and personal information, email contact@appsanic.com. This address handles all privacy enquiries; we aim to respond to privacy matters within 30 days, consistent with APP 12. A postal address for Encode Digital Software Solutions Pty Ltd (ACN 690 774 719) is available on request. You can also reach us through our contact page. If you are not satisfied with our response to a privacy concern, you may complain to the Office of the Australian Information Commissioner at oaic.gov.au or by phone on 1300 363 992.