Cookie & Storage Notice

This notice explains how Annot8 uses cookies, localStorage, sessionStorage, and similar browser technologies. It covers our own website and dashboard and the Annot8 widget when a customer installs it on another website. The customer operating that website is responsible for its own consent banner and for describing its use of Annot8.

• Clerk authentication cookies and related storage: authenticate users, protect sessions, prevent abuse, and support sign-in. Duration depends on session and browser settings.
• annot8-ui-theme: remembers the user's light or dark dashboard preference until it is changed or browser storage is cleared.
• activeOrgId: remembers the last selected workspace until it is changed or browser storage is cleared.
• annot8:cookie-consent:v2: records the analytics choice, policy version and decision time. Both acceptance and refusal expire after 180 days; older or invalid records do not authorize analytics.
• Dashboard view, onboarding, AI-panel, and notification preferences: remember choices requested by the signed-in user until changed or cleared.
• Security and deployment providers may set or access strictly necessary identifiers and request metadata to deliver and protect the Service.

These technologies support a service or preference requested by the user. Annot8 does not use advertising cookies on its website and does not sell or share browser data for targeted advertising.

• annot8-widget-position (localStorage on the customer's website): remembers where a visitor placed the launcher.
• annot8-theme-override, annot8-pins-hidden:<project> and annot8-emoji-recent (localStorage in the widget frame): remember the widget theme, whether pins are hidden, and recently used emoji.
• a8_visitor_id:<project> (localStorage in the widget frame): a pseudonymous identifier used to reconnect a visitor to their live-chat conversation on that site. It is kept separately for each site and remains until the widget's storage is cleared.
• a8_visitor_contact:<project>: remembers the name and email a visitor chose to submit for live chat on that site, until cleared. It is kept separately for each site.
• Origin-validation session records: short-lived server-side records that bind public widget actions to an allowed website origin; they expire after two hours.

The widget frame is served from annot8.app, so its storage belongs to that origin; most browsers partition it per embedding website. Whether these technologies are strictly necessary depends on how the customer deploys the widget and the visitor feature requested. Customers must obtain consent before loading or using them where local law requires it and should provide a way to withdraw consent.

• annot8:voter (localStorage): a random identifier that lets a visitor vote once per post without an account; remains until cleared.
• annot8:portal-identity (localStorage): remembers the name and email a visitor chose to enter on a portal so they don't retype it; remains until cleared.
• annot8:portal-following (localStorage): remembers which posts the visitor follows so the page can show it; following itself, and the update emails it triggers, are recorded server-side and stopped through the unsubscribe link in any update email.

When a visitor allows Analytics, annot8.app uses Google Analytics 4 and PostHog for acquisition, page-view, product-funnel, and web-vitals measurement. Both remain off when their deployment variables are absent. Advertising signals, PostHog autocapture, and session replay are disabled.

• Google Analytics may set _ga and _ga_* identifiers after consent. The app requests a 180-day cookie lifetime without refreshing it on each visit; browser restrictions may shorten this. Provider-side retention is separate.
• annot8:posthog-distinct-id:v1 (localStorage): a pseudonymous PostHog event identifier created only after consent and removed when Analytics is withdrawn.
• annot8:launch-attribution:v1 (sessionStorage): approved campaign labels, a coarse landing-page category, and an allowlisted external referrer hostname for the current browser session. Free-text campaign terms/content and unrecognized labels are discarded.
• Intentional funnel events cover product milestones with allowlisted categories and counts. Account, workspace, project, thread, run and checkout identifiers are excluded from event payloads. Browser identifiers remain pseudonymous, not anonymous; providers also receive connection metadata. A checkout-return event does not establish a successful payment.
• annot8:analytics-once:* (localStorage): local milestone deduplication records. These and attribution/PostHog storage are removed when analytics is withdrawn or an expired choice is detected; authentication and necessary preferences are retained.

Annot8 Analytics is off by default. It starts only when a customer enables Analytics and the host site explicitly sends analyticsConsent=true after obtaining any required consent.

• ca_visitor_id:<project> (localStorage on the customer's website): pseudonymous visitor measurement across sessions; remains until cleared.
• ca_session_id:<project>, ca_session_start:<project> and ca_session_activity:<project> (sessionStorage on the customer's website): group activity into a session, logically expiring after 30 minutes of inactivity and otherwise ending with the browser session.
• Server-side Analytics events and sessions: page origin and path (never query strings or fragments), page title, referrer origin and path, UTM campaign tags, click/scroll/error events, device, browser and OS categories, screen size, and a two-letter country code derived by our hosting provider's edge network (the IP address is not stored for Analytics), associated with those pseudonymous IDs; eligible for deletion after 395 days through an hourly, bounded-batch cleanup job. Failures or backlogs can delay completion. Customer administrators can also delete all of a project's Analytics data at any time.
• The widget does not start Analytics or create measurement identifiers in browsers that send Global Privacy Control (GPC) or Do Not Track (DNT=1), or in automated and headless browsers, even when the host site signals consent. A blocked tracker removes the optional analytics identifiers for that project.

Analytics is used for aggregate product and website measurement, not targeted advertising. Rejecting Analytics must not prevent access to the core feedback feature.

• Use Cookie settings in the Annot8 footer or the dashboard's Account & privacy page to allow, reject, or withdraw Analytics on annot8.app. Withdrawal stops new app events and reloads the page if a Google tag was loaded so its running code is unloaded; already delivered data is not erased by withdrawal.
• Use the customer website's consent controls to accept, reject, or withdraw optional widget Analytics.
• Customers must re-initialize the widget with analyticsConsent=false when consent is withdrawn. Once the project configuration is loaded, the widget removes that project's ca_visitor_id, ca_session_id, ca_session_start and ca_session_activity keys. If the widget cannot load, the host site's consent handler should remove those keys itself. Withdrawal stops future collection; previously delivered server records require a separate deletion request or the project's deletion controls.
• Browser settings can block cookies or clear cookies, localStorage, and site data. Blocking authentication storage may prevent sign-in; clearing widget storage may reset preferences and live-chat continuity.
• On annot8.app, Global Privacy Control (GPC) and Do Not Track (DNT=1) keep optional site analytics off, including when an older choice allowed it. This conservative product choice is separate from each customer's obligations for its own widget deployment. We do not use these analytics systems for targeted advertising.

We update this notice when storage names, purposes, providers, or durations materially change. Questions may be sent to privacy@annot8.app.