What we keep in your browser.

How Transglot uses cookies and similar technologies, such as local storage, on the marketing site and inside the product, what each one does, how long it lasts, and what you can do about it. Each entry below names the cookie exactly as your browser will show it. This document is part of the Privacy Policy, which explains everything else we do with personal data.

A cookie is a small text file a site asks your browser to keep and send back on the next request. Local storage is a related mechanism that keeps a value in the browser without sending it anywhere, so nothing in local storage ever reaches our servers unless the page deliberately puts it in a request. We use both, sparingly, and this document lists both. We use no device fingerprinting, no social network pixel and no share-button tracker. We do use advertising identifiers, and they are the newest thing on this page: a click identifier that a Google ad appends to the address it sends you to, the two cookies Google writes from it, and one cookie of our own that keeps the same identifier where the browser cannot reach it. All three are named below. One Google script serves both the analytics half and the advertising half, because Google’s rule is one tag to a page.

Optional tracking is off until a current affirmative choice, in every region. The banner offers acceptance and rejection together. Google Analytics, Google Ads, website-only Smartlook session recording and affiliate attribution do not run without permission. Google’s tags are not loaded before acceptance, so no cookieless measurement pings are sent through them. The tg_consent_v2 cookie remembers your choice across the website and product for 180 days. An old tg_consent acceptance is not reused, and an old refusal is respected. We do not guess your location from your time zone or use a regional exception to turn tracking on. Global Privacy Control is a refusal and overrides an earlier acceptance. Use Privacy choices or Do Not Sell or Share My Personal Information on either host at any time to reject or withdraw permission, without signing in or proving your identity. A signed-in refusal also prevents future server-side advertising uploads for that login. Essential sign-in, form-protection, sign-up security and user-selected preference storage continue; core features do not depend on optional tracking.

The sign-in session. It holds an identifier that points at a session record on our own servers, not your data, and it is what keeps you signed in as you move between screens. Set by us as a first party cookie on the host you are on, marked HttpOnly so page scripts cannot read it, with SameSite set to Lax, and encrypted. It expires after 120 minutes of inactivity, and each host (the marketing site, the app, the API and the admin surface) keeps its own separate session rather than sharing one. Blocking it means you cannot sign in.

Cross site request forgery protection. It carries a token the page reads and sends back with every form and every write request, so that a request coming from another site cannot act as you. Set by us as a first party cookie, deliberately readable by the page (that is the entire mechanism), with SameSite set to Lax, and it expires with the session at 120 minutes. Blocking it means every form on the site fails.

The persistent sign-in cookie, set only if you tick "Remember me" on the sign-in form. It holds a long random token, tied to your login, that lets a later visit re-establish a session without asking for your password again. First party, HttpOnly, encrypted, and long lived by design (Laravel’s default horizon for this cookie is five years). Signing out clears it. Do not tick the box on a shared computer, and if you think a device has been lost, change your password, which invalidates it.

A security token for sign-up. It is set on the app host when you open the sign-up or sign-in page, sign in with a social provider, create an Account or create a workspace, and it holds 32 random characters that identify the browser, not you: no name, no email address and nothing read from the browser itself. We never store the token. We store a keyed hash of it beside a keyed hash of the network range the request came from, and we use that pair only to tell whether a sign-up comes from the same browser and network as an Account that already received a free allowance, as the Privacy Policy describes. First party, HttpOnly, Secure, SameSite Lax, and host-only on the app host, with a lifetime of 400 days. It is not encrypted, because the value is already random and carries nothing. It is strictly necessary as a security measure, so it is set whatever you answer the consent banner. Delete it and the next sign-in sets a new one.

The light or dark theme you chose inside the product, kept so the page can paint the right ground before the first frame instead of flashing white at you. Set by the page as a first party cookie with a lifetime of 365 days, readable by the page, and deliberately not encrypted so the server can read it during the first render. It holds one of three words: light, dark or system. Nothing about you is in it.

Whether you left the product sidebar open or collapsed, so it comes back the way you left it. Set by the page as a first party cookie with a lifetime of 7 days, readable by the page, not encrypted. It holds true or false.

Records a current choice of granted or denied for optional tracking, including refusal through Global Privacy Control. It contains no identifier or browsing history. First party, readable by the page and not encrypted so the earliest consent check and the server agree before any optional tag can load; SameSite Lax, scoped across our subdomains, with a lifetime of 180 days. The former tg_consent cookie is not accepted as proof of consent: a legacy acceptance requires a new affirmative choice. A legacy refusal is respected. Deleting the current choice cookie restores the default of no optional tracking, unless a signed-in refusal or Global Privacy Control also applies. The controls remain available after any choice.

Set only with optional-tracking permission when you arrive through a Founding Partner referral link or a link carrying a referral parameter. Without permission, the link still opens but no optional attribution is recorded. It holds a random 32 character token that identifies the link you followed, not you: no name, no email, no browsing history. If you later sign up, the token is what credits the partner who sent you, through the first Account you create. First party, HttpOnly, encrypted, SameSite Lax, with a lifetime of 60 days, which matches the attribution window in our partner terms. Like the consent and advertising cookies around it, it is scoped across our subdomains, because the link is followed on the marketing site and you sign up on the app. Deleting it removes this browser’s attribution token; it does not erase historical referral records or undo attribution already recorded.

Set only with current optional-tracking permission when you arrive on a link carrying a Google click identifier, which is what a Google ad appends to the address it sends you to. It holds that identifier, the campaign parameters that came with it and the path you landed on, so that a conversion finished later, or finished where no browser is present at all, can be credited to the ad you actually clicked: a subscription confirmed by our payment processor hours after you closed the tab has no page to fire from, and this is how that conversion finds its click. First party, HttpOnly so page scripts cannot read it, encrypted, SameSite Lax, and a lifetime of 90 days, which is the window Google will still accept a conversion in and is deliberately not the 60 days the partner cookie uses. It is scoped across our subdomains, because the ad is clicked on the website and you sign up in the product. Without permission, or with Global Privacy Control, it is not written or read. Refusal clears this attribution cookie and stops future attribution; a signed-in refusal also removes saved attribution and unsent conversion identifiers. Clearing browser cookies removes this browser cookie; it does not erase attribution already saved to a login or withdraw a saved permission. Use Privacy choices while signed in to stop future server-side advertising uploads for that login.

Three keys of ours live in local storage rather than in a cookie, which means the browser keeps them and does not attach them to requests. "tg-theme" holds the light or dark choice for the marketing site. "appearance" holds the same choice for the product, mirroring the cookie so the page can react without a round trip. "taip:last-project" followed by your workspace name holds the last project you opened in that workspace, so the product can take you back there. Clearing site data in your browser removes all three and costs you nothing but those preferences.

The product and the website can carry an in-app support messenger from a third party support provider. When it is enabled it loads that provider’s script and the provider may set its own cookies and storage in your browser to keep a conversation together across visits, under its own privacy policy; when it is signed in it receives your name, your email address and your login identifier so a conversation can be attributed to you. It is switched off unless a support identifier is configured, and it never loads on the in-context editor, the embed surfaces, the API or the delivery endpoints. The Subprocessors document sets out the category and what the provider receives, and the named vendor list is furnished on request under a non-disclosure agreement.

Google Analytics. The value in it is a randomly generated identifier for the browser: no name, no email address, no login, and nothing you typed. Its whole job is to let a reader who comes back be counted as one person rather than two, so that a page view figure means something. Set by the Google Analytics script as a first party cookie with a lifetime of 2 years, readable by page scripts and therefore not HttpOnly, and not encrypted. Like the referral cookie it is scoped across our subdomains, so one browser carries one identifier on both the website and the app. On the website property Google Signals is switched on, which means Google may join that identifier with the Google account of a reader who is signed in to Google and has ads personalisation turned on in their own Google settings, and use the result to build a remarketing audience. On the product property it is switched off, so no such join happens to anything you do inside your workspace. Blocking the cookie costs you nothing: every feature works without it.

Google Analytics again, and one of these exists for each property. It holds the state of the visit you are in, such as when it started and how many you have made, which is what groups a run of page views into a single session. Set by the same script, first party, 2 years, readable by page scripts, not encrypted. We run two properties, one for this website and one for the product, and we keep them apart on purpose: the two hosts serve different people asking different questions, and merging them would make every figure on both a blend of the two. A browser that has seen both therefore carries two of these. Everything said above about what these cookies do not hold applies here as well.

The conversion linker. Google Ads writes it the first time the tag runs, and it holds a randomly generated identifier for the browser that lets a conversion recorded on one page be joined to the ad click recorded on another. Google’s script sets it as a first party cookie at transglot.ai rather than at each host, and that is the whole point of it: the ad is clicked on the website and you sign up in the product, so a cookie readable on only one of them would leave every signup looking like it arrived from nowhere. Lifetime 90 days, readable by page scripts and therefore not HttpOnly, not encrypted. It is not written while consent is denied.

Written only when you arrive from a Google ad, and it holds the click identifier from that ad so that a conversion you make later is attributed to it. Set by the same Google script, first party, 90 days, readable by page scripts, not encrypted. It is the browser half of what our own tg_ads cookie keeps on the server, and both exist because a conversion can be finished with the browser present or long after it has gone. It is not written while consent is denied.

Smartlook, a session recording service, which we run on this website and not inside the product. It records how a page is used, meaning clicks, scrolling, mouse movement and what the page showed, so we can see where a page confuses people. What you type into a form is not recorded, and neither are email addresses, numbers or your IP address: those are Smartlook’s defaults and we have not changed them. The cookie holds a random visitor identifier and a session identifier next to our project key, so the pages of one visit play back as one recording. Set by the Smartlook script as a first party cookie with a lifetime of 13 months, readable by page scripts, not encrypted. A second cookie, SL_C_23361dd035530_DOMAIN, lives only while the script works out our base domain and is then removed. The script also keeps two keys in local storage: SL_L_23361dd035530_SID with the same identifiers, and SMARTLOOK_LS_QUEUED_CHUNKS with recorded data waiting to be sent. Smartlook stores the recordings in the European Union. In every region the script stays unloaded until you affirmatively accept optional tracking. It stays off after refusal or a Global Privacy Control signal, even if an earlier choice was acceptance. Blocking it costs you nothing.

No social network pixels or share-button trackers. No fingerprinting for tracking or advertising. The browser check on sign-up and workspace forms reads browser signals to tell a person from a script, sets no cookie, and is used for nothing else. No cookie from a data broker and no sale of browsing information for money. Permission-based Google advertising sharing is described above and in Privacy Policy clause 24. No session recording inside the product: Smartlook runs on this website only. No advertising audience built out of what you do inside the product: on the product property Google Signals and ad personalisation are both switched off, which is what keeps product usage a count of conversions rather than a profile of a customer. On this website they are on, and the entries above say which cookies carry it. Payment is taken on our payment processor’s own pages rather than on ours, so their payment scripts do not run here. Our delivery endpoint sets no cookie at all, which is deliberate: a public bundle URL that carried a cookie would be a tracking surface hidden inside a product feature.

Open Privacy choices or Do Not Sell or Share My Personal Information on either host to see the current choice and accept or reject optional tracking. These controls are available without a login and also work as an ordinary server-rendered form when JavaScript is disabled. Optional tracking is off worldwide until a current affirmative choice; legacy acceptance is not reused. Rejecting records a refusal across our subdomains for 180 days, clears our readable optional cookies and Smartlook storage on the current host, and reloads the page without optional tracking scripts. Global Privacy Control overrides acceptance. A refusal made while signed in is saved for the login and blocks future server-side advertising uploads, including queued conversions. A new affirmative choice is needed to permit them again. A choice on one browser cannot identify other anonymous browsers, and browser controls may be needed to clear third-party or other-host storage. Withdrawal stops future tracking but does not recall data already sent; contact privacy@transglot.ai for applicable access or deletion rights. You can also block scripts, block cookies or clear site data in your browser. Essential sign-in and form cookies must be allowed for those functions to work; optional tracking is never needed to use the Service.

We update this document whenever we add, remove or change a cookie, and we change the effective date at the top when we do. Because the list above names each cookie exactly, a change here is a real change to the product rather than a rewording. Questions go to privacy@transglot.ai.