Cookie Policy

Overview

This Cookie Policy explains how Appsanic uses cookies and similar browser storage when you visit appsanic.com and use the Appsanic service. Appsanic is operated by Encode Digital Software Solutions Pty Ltd (ACN 690 774 719), a company registered in New South Wales, Australia (Appsanic, we, us or our). Appsanic is the product and trading name of that company.

This policy should be read together with our Privacy Policy, which describes how we handle personal information in accordance with the Australian Privacy Principles (the APPs) in the Privacy Act 1988 (Cth), and with our Terms of Service. It gives a precise account of what we store on your device and describes the service as it operated on 6 November 2026.

In summary: we set three strictly necessary cookies, and only when you sign in or reset your password. Two keep you signed in and one protects a password reset. We keep three values in your browser’s own storage: your appearance choice, a marker used while you complete a plan purchase, and an idea you type on the public site before you sign in. Your browser never sends these values to our servers on its own. The idea reaches our servers only when you sign in and start it as a request to Sanic AI, the AI app engineer in the editor, as described under Browser storage.

We use no advertising, analytics or cross-site tracking cookies, we load no third-party scripts or tags, and we show no cookie banner because we store nothing beyond what is needed for an action you have asked us to carry out.

What cookies and browser storage are

Cookies are small text records that a website asks your browser to keep on your device. On each later request to the same site, the browser sends the cookie back, which lets the site recognise your session, keep you signed in or remember a choice you made. A cookie has a name, a value, an expiry and security attributes, for example whether it is sent only over encrypted connections, whether it is hidden from scripts running in the page, and which paths on the site receive it.

Appsanic also uses two browser storage mechanisms that are related to, but technically distinct from, cookies:

localStorage keeps small values on your device until you or your browser clear them. Unlike a cookie, the contents are never sent to a server automatically; they stay on your device and are read only by the Appsanic interface running in your browser.
sessionStorage behaves the same way but belongs to a single browser tab and is cleared when that tab is closed. We use it for short-lived hand-off values that carry you from one screen to the next.

In this policy, “cookies” means cookies only. We refer to localStorage and sessionStorage together as “browser storage” and say which of the two applies in each case.

Our approach

We take a data-minimising approach. We use the smallest set of cookies and stored values needed to run the service securely, and we do not load advertising or analytics technology. In practice this means:

Strictly necessary only. The only cookies we set are those required to keep you signed in and to complete a password reset you have started. They are set by our own server, on our own domain, and only after you have asked to sign in or reset your password.
Nothing to consent to. We store no cookie and no browser value beyond what is needed for an action you have taken: signing in, resetting a password, choosing an appearance, completing a purchase or carrying an idea into the editor. There is no banner, no consent cookie and no preference centre. If we ever introduce storage that the law treats as non-essential, we will update this policy and ask for your consent first where the law requires it.
No tracking. We do not profile you, build advertising audiences or share device identifiers with advertising networks. There is nothing to opt out of, because we do none of this.
Kept on your device. Interface conveniences such as your appearance choice are kept in your browser’s own storage and never transmitted to us. An idea typed on the public site also stays in your browser until you sign in and send it to Sanic AI.

This reflects the APPs, which we apply to the personal information we handle and which require us to collect only what is reasonably necessary for our functions (APP 3) and to be open about our handling (APP 1). It also reflects the rule in the ePrivacy laws of the European Union and the United Kingdom, where they apply, that consent is required for any storage on your device that is not strictly necessary to provide a service you have requested.

Categories we use

We group what may be stored on your device into three categories. Today Appsanic uses only the first two. The third is listed so that our position is unambiguous.

Strictly necessary cookies: The session cookies that keep you signed in and the short-lived cookie that protects a password reset. Without these the service cannot sign you in. Australian law requires no consent for them, and the ePrivacy rules of the European Union and the United Kingdom exempt cookies that are essential to deliver a service you have requested. Blocking them prevents signing in and, because a plan purchase starts from your signed-in account, checkout.
Functional browser storage: Your appearance choice (light or dark), a return marker used while you complete a plan purchase, and an idea typed into the public site before you sign in. These live in your browser’s localStorage or sessionStorage, not in cookies, and your browser does not send them to our servers on its own. The saved idea leaves your browser only when you sign in and start it as a Sanic AI request. They are limited to what you have asked the interface to do, so no consent banner is shown; you can clear them at any time through your browser.
Advertising, analytics and tracking: None. We use no third-party advertising, analytics, product-telemetry or cross-site tracking cookies of any kind, and no third-party script or tag is loaded on our pages. Consent is not applicable because there is nothing to consent to.

Cookies we set

Appsanic’s own server sets exactly three cookies, all on the appsanic.com domain. None is set while you browse the public website, the documentation, the pricing page or this policy. The first two are set when you sign in, including when you confirm a new account or a sign-in link, and are reissued each time your session is refreshed; the third is set only during a password reset. The sign-in service we use (the authentication service that holds your credentials and verifies your sessions on our behalf, described in our Privacy Policy) places no cookie of its own in your browser.

appsanic_access: Strictly necessary. Holds the access token for your signed-in session so that each request to the dashboard, the editor and your account pages is recognised as yours. Lifetime: as long as the access token, about one hour, renewed while you use the dashboard or the editor. Attributes: HttpOnly (not readable by scripts), Secure (sent only over HTTPS), SameSite=Lax, Path=/.
appsanic_refresh: Strictly necessary. Holds the refresh token used to obtain a new access token so that you stay signed in across visits without entering your password again. Lifetime: 30 days from the last time it was issued; it is reissued while you use the dashboard or the editor, so you remain signed in for as long as you use Appsanic at least once every 30 days. It is set because you chose to sign in. If you prefer not to stay signed in, sign out at the end of each visit, which removes it. Attributes: HttpOnly, Secure, SameSite=Lax, Path=/.
appsanic_recovery: Strictly necessary. Set only after you open a password reset link and press “Continue securely”. Opening the reset link in this way also clears any signed-in session cookies in that browser, so you sign in again once the new password is saved. It holds an encrypted proof that lets you set a new password and nothing else: it grants no access to the dashboard, billing or projects. Lifetime: at most 15 minutes, and it is cleared once the new password is saved. Attributes: HttpOnly, Secure, SameSite=Lax, limited to the path /api/platform/session, the account session endpoint, where only the password reset actions read it.

Each session cookie holds one token and nothing more; no cookie value is split across several cookies. Signing out ends your session with the sign-in service and clears both session cookies, and it clears appsanic_recovery if that is present. Changing your password signs out every other device, and a completed password reset signs out every session. When an account deletion is requested, the session cookies are cleared immediately.

The values of appsanic_access and appsanic_refresh identify your account, so when your browser sends them to us they are personal information. We use them only to recognise your signed-in session and to protect your account. Each request carrying them is handled by the provider that hosts our website and serverless functions, and your session is verified with our sign-in service in Australia; both are described by role in our Privacy Policy, which also sets out the overseas locations involved and how to access or correct your personal information or make a complaint. We use these values for no other purpose and never give them to advertisers or data brokers.

If you used an earlier version of Appsanic, your browser may still hold cookies that the earlier service set on appsanic.com, for example appsanic-consent, appsanic-csrf, an sb-prefixed authentication cookie, or the connector sign-in cookies gh_oauth_state, gh_oauth_user, gh_oauth_account, sb_oauth, sb_picker and st_oauth. The current service does not set, read or rely on any of them. Sessions are held in the two Appsanic cookies above; requests that change data are accepted only when they originate from appsanic.com, rather than being protected by a double-submit cookie; nothing requires a consent record; and no sign-in or OAuth flow with another service runs inside Appsanic. Those older cookies expire on their own, and you can delete them at any time through your browser’s site-data controls.

Session cookie values are credentials for your account. If we became aware of a data breach involving them that was likely to result in serious harm, we would notify you and the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme, as our Privacy Policy explains. Interface preferences are not held in any cookie; they are kept in browser storage, as described under Browser storage.

A consent banner exists to let you accept or refuse storage that is not needed to provide what you asked for, typically analytics, advertising or personalisation. Appsanic has no storage in that class. The three cookies above are needed to sign you in and to reset a password, and the three browser storage values below exist only to carry out an action you have taken in the interface.

Australian privacy law has no cookie consent requirement; it requires us to collect only the personal information reasonably necessary for our functions and to be open about how we handle it, which this policy and our Privacy Policy do. The ePrivacy rules of the European Union and the United Kingdom, where they apply, require consent only for storage that is not strictly necessary for a service you have requested.

Because there is no choice to record, we set no consent cookie and keep no record of a consent decision. Your control is through your browser, as described under Managing cookies and browser storage.

Browser storage

Appsanic keeps three values in your browser’s own storage rather than in cookies. These values are device-local: they live in your browser and are read only by the Appsanic interface on your device, and your browser never sends them to our servers on its own. The one exception is the idea you type on the public site, which reaches your account only when you sign in and start it as a Sanic AI request, as described below. No project document, saved conversation, password or session token is ever kept in browser storage.

appsanic.product-theme (localStorage): Records whether you chose the light or dark appearance for the dashboard, the editor and the sign-in pages. It is written only when you change the appearance yourself, read when the application loads, and kept in step across open tabs. It stays until you or your browser clear it. In a private window the choice lasts until that window is closed; when storage is blocked it lasts until the page is reloaded.
appsanic.billing-return (sessionStorage): Holds your account identifier and workspace identifier (no name, email address or payment detail) while you are away on our payment provider’s checkout or billing portal pages, so the page you return to shows the right account. It is read only on the billing return pages, removed as soon as the return is handled, and grants no access. The purchase itself is confirmed by our server from the payment provider’s records, whether or not this value exists.
appsanic.public-composer.v1 (sessionStorage): Holds an idea you type into the composer on the home page or the Sanic AI page before you sign in, together with the model tier and effort level you chose, the Use project theme, Build plan and Design review settings, and an optional project brief (up to 12,000 characters of idea and 6,000 of brief). The public page sends nothing to our servers, and a brief containing a recognised provider credential is refused. The value belongs to that browser tab alone and is cleared when the tab closes.

After you sign in, the dashboard offers to create a project, open an existing one or discard the saved idea. When you create or open a project, the idea, brief and settings are sent to our servers as a Sanic AI request if your plan allows it; otherwise they are prepared in the conversation for you to send. From that point they are project content handled under our Privacy Policy, which covers their disclosure to our AI model provider when the request is sent. The stored copy is marked before sending so that a page refresh cannot repeat a paid request, and it is removed once the idea has been sent.

Do not type passwords, keys or sensitive personal information into the composer: once sent, the idea is handled like any other Sanic AI message.

Your choice of Sanic AI model and effort, panel sizes and other editor state are held in memory for the current session only and are not written to browser storage. Your projects, including their App settings, the project brief and the Build plan and Design review preferences, and your conversations are saved to your account on our servers, never in your browser.

You can clear these values through your browser’s developer tools or site-data controls. Clearing all site data for appsanic.com also removes the session cookies and signs you out; clearing only local and session storage resets your appearance choice and discards any unsent idea without signing you out.

Third-party cookies

We embed no advertising pixels, social-media trackers or third-party scripts of any kind, and our pages load fonts from our own domain rather than from a font service. No third-party script runs on appsanic.com. Our content security policy admits one outside host for scripts and frames, kept for a sign-in challenge that is switched off, so nothing is loaded from it today. If that challenge is switched on, this policy will be updated first to describe it and any cookie it sets.

Some steps of the service take you to pages that other organisations operate, and those organisations may set cookies on their own domains under their own policies:

Checkout and the billing portal are hosted by our payment provider on its own pages. Any cookies used there are set by the payment provider on its domain, not on appsanic.com, and are governed by its privacy and cookie policies.
Phone testing uses the Expo Go app on your phone and, when you connect your Expo account by entering an access token you created there, Expo’s own services. You sign in to Expo on Expo’s own website or app to create that token, outside Appsanic. Anything the Expo Go app stores on your phone, or that Expo’s pages store in your browser, is governed by Expo’s own policies, not by this one.
Connectors (Supabase, WordPress, Shopify, RevenueCat, OneSignal, Algolia and Sentry) are configured by entering public details in the editor. Connecting them involves no sign-in flow inside Appsanic and sets no cookies. The apps you build contact those services directly under your own accounts, and any storage those services use is governed by your agreements with them.

The browser preview in the editor runs your app in an isolated frame with an opaque origin and no cookies or storage of its own. If your app embeds a map, a web page or media from another site, your browser loads that content from the site concerned, which may set cookies on its own domain under its own policy; nothing is set on appsanic.com.

The organisations that process data on our behalf are, by role: the sign-in, database and file storage provider in Australia; the website host, whose primary region is in the United States; the worker host in Singapore; and, in the United States, our AI model provider, our payment provider and our email delivery provider. Our Privacy Policy describes what each receives.

Managing cookies and browser storage

You can review, restrict or delete cookies through your browser’s settings, and you can clear the browser storage values described above through the same site-data controls. Every major browser lets you view the cookies and site data stored for appsanic.com, delete them for this site alone, or block storage for this site in future. Google Chrome, Apple Safari, Mozilla Firefox and Microsoft Edge each publish help pages with the exact steps.

Because the only cookies we set are strictly necessary, there is no Appsanic setting for turning cookies on or off, and we cannot offer a working signed-in session without them. The practical effects of your browser choices are:

Blocking appsanic_access and appsanic_refresh prevents signing in, and deleting them signs you out. The dashboard and editor cannot work without them, and a plan purchase cannot be started because it begins from your signed-in account.
Blocking appsanic_recovery prevents a password reset from completing. You can still request a reset link, but a new password cannot be saved.
Blocking localStorage means the appearance choice lasts only until the page is reloaded.
Blocking sessionStorage stops the composer on the public site from saving your idea; it shows a message asking you to allow session storage, and you can instead sign in and type the idea in the editor. A plan purchase is still recorded against your account when you return from checkout, because our server confirms it from the payment provider’s records.
The public website, documentation, pricing page and this policy work with all cookies and storage blocked; only the composer needs session storage.

No advertising, analytics or cross-site tracking

Appsanic contains no advertising cookies, no analytics or product-telemetry cookies and no cross-site tracking, and it records no feature-interaction telemetry. The only records we hold about your use of the service are those described in our Privacy Policy: account, project, Sanic AI usage, phone preview time and billing records, together with short-lived hashed rate-limit counters, handled in accordance with the APPs. We do not use them to build advertising profiles, and we do not sell them or share them for advertising.

Users outside Australia

If you are in the European Union or the United Kingdom, the cookies described above are placed as strictly necessary for the service you have requested under the ePrivacy rules, and the personal data they carry is processed to perform our contract with you and to keep your account secure (Article 6(1)(b) and (f) of the GDPR and the UK GDPR), where those laws apply. Our Privacy Policy explains how that data is transferred outside the European Economic Area and the United Kingdom and the rights you have, including access, erasure and objection.

If you are a resident of California, we do not sell personal information, we do not share it for cross-context behavioural advertising, and we set no cookies for targeted advertising, so there is no Do Not Sell or Share choice to make. Because our site performs no tracking, it does not change its behaviour in response to Do Not Track or Global Privacy Control browser signals; there is nothing for those signals to switch off. Our Privacy Policy describes the personal information we collect and your rights in relation to it.

Changes to this policy

We may update this Cookie Policy when the cookies or storage we use change or when the law changes. Each version carries its Last updated date at the top of this page, and we publish every change here before it takes effect. If a change would introduce storage that is not strictly necessary, we will describe it here and obtain your consent before it is set where the law requires it. Changes do not apply to anything stored on your device before they took effect. Nothing in this policy limits your rights under the Privacy Act 1988 (Cth) or the Australian Consumer Law. We recommend reviewing this page whenever the Last updated date changes.

Contact

For questions about this Cookie Policy or our handling of cookies and personal information, email contact@appsanic.com. This address handles all privacy enquiries. We aim to respond to privacy enquiries, requests for access to or correction of personal information, and complaints within 30 days. A postal address for Encode Digital Software Solutions Pty Ltd (ACN 690 774 719) is available on request. This policy is available free of charge on our website, and we will provide a copy in another form on request. You can also reach us through the contact page. Please leave passwords, keys and other private information out of your message.

If you are not satisfied with our response to a privacy concern, or you have not received a response within 30 days, you may complain to the Office of the Australian Information Commissioner (OAIC). The OAIC accepts complaints through the online form on its website or by post to GPO Box 5288, Sydney NSW 2001. Its enquiries line is 1300 363 992.