Cookie Policy

This Cookie Policy explains what cookies and similar browser storage OrgDeck uses, and why. It supplements our Privacy Policy, which covers personal information more broadly. We keep this short on purpose: OrgDeck uses a small, fixed set of cookies to run the Service — nothing for advertising or tracking you across other sites.

A cookie is a small piece of data a website asks your browser to store and send back on later requests. Because the web is otherwise stateless, cookies are what let a site recognize you from one page load to the next — for example, staying signed in without re-entering your password on every page.

Session cookies (strictly necessary). When you sign in, our authentication provider (Supabase) sets a small set of cookies that identify your logged-in session on every request. These are essential — without them, the Service can't tell who you are, and features like your dashboard, organization roster, and operations couldn't work. They're cleared when you sign out, or expire automatically after a period of inactivity.

Equipped theme cookie (functional). If you own and equip a personal cosmetic theme from the Store, we set a cookie named orgdeck-accent so your chosen accent color renders correctly on your very first page load, before the page has a chance to check the database. It's HttpOnly (not readable by page scripts), stores only a 6-character color value, and lasts up to a year or until you unequip the theme, whichever comes first.

Analytics cookie (analytics). We use PostHog to understand how OrgDeck is used — which pages people visit and which features they use — so we know what to improve. It sets a first-party cookie named ph_<project key>_posthog (with a matching local-storage entry) holding a random visitor ID and, once you sign in, your account ID. It lasts up to a year. Analytics requests go through our own domain and are never used for advertising. If your browser sends a "Do Not Track" or Global Privacy Control signal, we don't collect any usage data from it.

If you're in the EU, EEA, UK or Switzerland, this cookie is only set after you accept it in the banner we show on your first visit. Until you accept — or if you decline — we only count visits anonymously, without any cookie or other storage on your device and without linking them to your account. Everywhere else it's on by default, and anyone can turn it off below.

Consent cookies (strictly necessary). orgdeck-consent-region records whether your location requires us to ask before using analytics cookies (for the current browser session only), and orgdeck-analytics-consent remembers your accept/decline choice for a year, so we don't ask again on every visit.

What we don't use: advertising cookies, session recording, or cross-site tracking of any kind.

Your light/dark theme mode preference is saved in your browser's local storage, not a cookie — it stays on your device and is never sent to our servers. It's used purely to remember your display preference between visits.

A few actions briefly take you to a page hosted by someone else, who may set their own cookies under their own policy — not ours:

• Stripe — if you subscribe or make a purchase, checkout and billing management happen on Stripe's own hosted pages.
• Discord — if you choose to sign in with Discord, the sign-in flow happens on Discord's own domain.

We don't control these cookies and recommend checking Stripe and Discord's own cookie/privacy policies if you want details.

Analytics: accept or decline the analytics cookie here at any time. Your choice applies to this browser.

Most browsers let you view, delete, or block cookies through their settings. Since our session cookie is what keeps you signed in, blocking or deleting it will sign you out and may prevent you from using parts of the Service that require an account.

We may update this policy if the cookies we use change. We'll update the "Last updated" date above when we do.

Questions about this policy? Reach out at orgdeckinfo@gmail.com, or use the in-app bug report form if you're already signed in.