1. The short version
GenieFolder sets only strictly necessary cookies required to keep you signed in. We use no analytics cookies, no advertising cookies, no social-media pixels, and no cross-site tracking. Because every cookie we set is strictly necessary for the service you request, we do not show a cookie-consent banner; if we ever add non-essential cookies, we will update this policy and ask for consent first.
2. Cookies we set
| Cookie | Purpose | Lifetime | Properties |
|---|---|---|---|
gt_access | Short-lived session token (JWT) that authenticates your API requests after you sign in. | About 15 minutes | HttpOnly, SameSite=Lax by default, Secure in production |
gt_refresh | Refresh token used to obtain a new session without asking you to sign in again. Rotated on every use; only its SHA-256 hash is stored server-side. | Up to 30 days | HttpOnly, SameSite=Lax by default, Secure in production |
Both cookies are HttpOnly, so they are not readable by scripts running in the page, and they are never stored in localStorage/sessionStorage. Signing out clears both cookies.
3. Browser storage used by local processing (not cookies)
For completeness, these browser storage mechanisms are used but are not cookies:
- Service worker Cache Storage. GenieFolder installs a service worker that caches the app shell and static assets so the tools load fast and keep working offline. API and authentication responses are never cached.
- In-memory working data. While you process files locally, your browser holds the files and results in memory only; this disappears when you close or reload the page.
localStoragein demo/offline mode. A small preference flag (gt_mock_plan) may be stored when using the demo (“mock API”) mode; it contains no file data and is never sent to any server.
4. What we do NOT use
- No analytics or measurement cookies (no Google Analytics, no ad-tech SDKs).
- No advertising, retargeting, or cross-site tracking cookies.
- No third-party cookies of any kind set by us.
If we ever add privacy-respecting analytics or any other non-essential cookie, we will list it here and update the Privacy Policy before it ships.
5. Managing cookies
You can block or delete cookies in your browser settings at any time. Blocking gt_access/gt_refresh will sign you out and prevent sign-in, but the free local-only tools on geniefolder.com keep working without any cookies or account — that is the point of local-first processing.
6. More information
For how we handle personal data generally, see our Privacy Policy; for how long we keep data, see the Data Retention & Deletion Policy. Questions: info@geniefolder.com.