1. The short version
GenieFolder sets only strictly necessary cookies required to keep you signed in. We use no analytics cookies, no advertising cookies, no social-media pixels, and no cross-site tracking. Because every cookie we set is strictly necessary for the service you request, we do not show a cookie-consent banner; if we ever add non-essential cookies, we will update this policy and ask for consent first.
2. Cookies we set
| Cookie | Purpose | Lifetime | Properties |
|---|---|---|---|
gt_access | Short-lived session token that authenticates your API requests after you sign in. | About 15 minutes | HttpOnly, SameSite=Lax, Secure in production |
gt_refresh | Refresh token used to obtain a new session without asking you to sign in again. Rotated on every use; only its SHA-256 hash is stored server-side. | Up to 30 days | HttpOnly, SameSite=Lax, Secure in production |
Both cookies are HttpOnly, so they are not readable by scripts running in the page, and they are never stored in localStorage/sessionStorage. Signing out clears both cookies.
3. Browser storage used by local processing
These are not cookies, but for completeness: GenieFolder’s local-first tools keep job state (for example, IndexedDB working data) inside your browser so your files can be processed without being uploaded. This data stays on your device and is cleared by your browser or by you. In demo/offline (“mock API”) mode, small preference flags such as gt_mock_plan may be stored in localStorage; they contain no file data and are not sent to any server.
4. What we do NOT use
- No analytics or measurement cookies (no Google Analytics, no ad-tech SDKs).
- No advertising, retargeting, or cross-site tracking cookies.
- No third-party cookies of any kind set by us.
- [Pending owner/lawyer: confirm with engineering before publication — if privacy-respecting analytics are added later, list them here and update the Privacy Policy §2.7 first]
5. Managing cookies
You can block or delete cookies in your browser settings at any time. Blocking gt_access/gt_refresh will sign you out and prevent sign-in, but the free local-only tools on geniefolder.com keep working without any cookies or account — that is the point of local-first processing.
6. More information
For how we handle personal data generally, see our Privacy Policy; for how long we keep data, see the Data Retention & Deletion Policy. Questions: info@geniefolder.com.