Legal
Cookies and tracking
Last updated: 27 October 2026.
The portal sets strictly necessary cookies only: your session (sra_session, HttpOnly), so you stay signed in, and
beside it a marker (sra_in, not HttpOnly, as long as the session), which holds no token and no identifier and only tells
our website's pages that you may be signed in, so they show your account instead of "Sign in"; and the editor pass
(sra_engine, HttpOnly, 7 days), which lets your signed-in browser load the editor's code. It keeps a few settings that never leave your browser (the account and address you last used, the theme, the last embed tab, your unsent draft of a request, the messages
behind the bell, the sign-up boxes waiting for your sign-in link). No consent banner is needed for strictly necessary
storage (§ 25 (2) no. 2 TDDDG). Product analytics in the portal and the editor run only with the account owner's
consent (§ 25 (1) TDDDG, Art. 6 (1) a GDPR): the portal asks once, and the switch in Settings → Legal and data gives or
withdraws it at any time. Without that yes, the portal sends no analytics and reads nothing in your browser for them;
with it, the events go with your session and nothing further is stored (privacy policy, product analytics). When you connect an app (Claude, ChatGPT, a WordPress site's plugin) and are not signed in, the consent page sets a
further strictly necessary cookie, sra_pending (HttpOnly, 60 minutes): it ties the sign-in code we mail you to that tab,
and goes when you are signed in.
The website measures visits with our own analytics, which set no cookie and store nothing in your browser (a daily code formed on our side tells visits apart; details in the privacy policy). It keeps a few display choices in your browser's local storage (the theme, an offer you closed), which never leave your browser. Global Privacy Control and Do Not Track are respected: nothing is recorded. Paddle's checkout, when you open it, sets Paddle's own cookies for the purchase; Paddle's cookie policy applies there. When you react to a post or a template, your browser keeps your own reaction in its local storage, set only by your click, so you can change it; strictly necessary for the function you asked for (§ 25 (2) TDDDG).
Modules on customers' sites set no cookie and no identifier in the visitor's browser. We count views per module and host as numbers. Fonts are served from our edge, not from Google.
Mails: product news sent through Brevo carries Brevo's open pixel and tracked links, as does an account mail in the rare case it goes through Brevo because Cloudflare could not take it; our other mails carry no tracking and their links are direct addresses.
Should a marketing pixel or a third-party analytics tool ever be added, a consent banner comes with it and this page says so first.