Cookie policy

Essential storage is used without optional consent because it is needed to provide sign-in, security, billing, and saved privacy choices. Analytics and marketing measurement remain denied unless you opt in through the privacy choices dialog. You can reopen that dialog from “Cookie preferences” in the website footer.

• Session cookie: __Host-codara_session is a secure, HttpOnly, host-only cookie for console sign-in. Its default lifetime is seven days; logout revokes the session and clears it. A renewed sign-in can start a new lifetime.
• OAuth state: short-lived server-side values protect provider sign-in against replay and request forgery. They are consumed once or expire.
• Interface preferences: local browser storage may remember display choices such as theme, selected organization, and read notification markers. It does not enable cross-site advertising.
• Consent record: the codara_consent_v1 cookie stores your analytics and marketing choices for up to 180 days. The choice is shared by pages under the same main domain. When you follow a link between codarasolutions.com and codaracloud.com, a rejection may travel with you, but a link never grants analytics consent. A new destination asks for its own acceptance; an existing local choice is preserved.
• Local development session: only when a developer deliberately connects a localhost console to Codara Cloud, a browser token may be stored for that local origin.

When configured and only after you accept, optional measurement uses: PostHog (product analytics and session recording, hosted in the European Union; ph_…_posthog cookies and local storage) and Google Analytics 4 (provided by Google Ireland Limited; _ga and _ga_* cookies). Google consent signals default to denied and are updated from your choice. Analytics may measure pages, product journeys, and conversion events; marketing measurement may attribute a signup or purchase to a campaign. Nothing loads because you reject or close the dialog.

With analytics accepted, PostHog gives your browser a pseudonymous identifier and keeps a profile of the pages and events it records. On codaracloud.com it may also record sessions (page structure, clicks and scrolling) to show how pages are used; text you type into form fields is masked before a recording leaves your browser. In the console, accepted analytics are linked to your Codara account ID, never to your email address, and sessions are not recorded. With analytics or marketing accepted, the site also keeps a codara_attribution_v1 entry in local storage with the campaign that brought you here (campaign parameters and advertising click IDs, landing page and referring site) for up to 90 days, so a later signup can be attributed to that campaign. Before you accept, it is held only in memory and discarded when you leave.

PostHog’s browser cookie normally lasts up to 365 days from an update. Its associated local storage remains until it is cleared; withdrawing consent stops optional capture and removes the stored analytics identity through the site’s consent controls. Google Analytics cookies normally last up to two years from an update, subject to shorter browser limits. These browser lifetimes are distinct from provider-side event retention. You can inspect and remove exact stored values in your browser’s site-data settings.

Google and PostHog may process account/support data or allow access outside the EEA under applicable transfer safeguards. See our Privacy Policy and provider register. Stripe/Link checkout and external sign-in pages use their own necessary storage and publish their own cookie notices; those pages are controlled by the provider.

You can clear site data in your browser, but deleting necessary session storage signs you out and may reset preferences. Questions can be sent to cloud@codaracloud.com.