Cookie Policy

1. What cookies are

Cookies are small text files that a website stores in your browser. They let a site remember information between pages and visits — for example, that you are signed in. "Similar technologies" include browser storage (such as localStorage) that works in a comparable way. We describe both here.

2. How we use cookies

We use cookies and browser storage only to make the Services work and keep them secure. Specifically, to:

Keep you signed in

Maintain your authenticated session so you don’t have to log in on every page.

Protect your account

Support security features such as two-factor authentication and defend against session hijacking and cross-site request forgery.

Remember basic preferences

Store lightweight settings, such as your light/dark theme choice, in your browser so the interface looks the way you left it.

We do not use cookies to build advertising profiles, and we do not sell or share cookie data for cross-context behavioral advertising.

3. The cookies we set

Strictly necessary — authentication

When you sign in, our authentication system (Better Auth) sets a session cookie that identifies your logged-in session. The tenant application uses a "coff"-prefixed cookie; the separate platform-admin console uses a "coff-admin"-prefixed cookie. In production these are served with the "__Secure-" prefix and are marked HttpOnly, Secure, and SameSite so they are sent only over HTTPS and are not readable by page scripts. These cookies are essential — the Services cannot keep you logged in without them — and they expire when your session ends or you sign out.

Strictly necessary — security

We may set short-lived cookies to protect authentication flows, such as verifying two-factor sign-in and preventing cross-site request forgery on sensitive actions.

Preferences (browser storage)

Your interface preferences, such as the marketing site’s light or dark theme, are stored locally in your browser (localStorage) rather than sent to our servers. Clearing your browser storage resets these.

4. Third-party cookies

We do not use third-party advertising networks, analytics trackers, or social-media pixels that set cookies on our Services. Two areas involve other companies in a limited way:

Payments (Whop)

When you make a payment, our processor Whop may set cookies needed to process the transaction securely and prevent fraud, governed by Whop’s own cookie and privacy policies.

Google sign-in

If you choose to sign in with Google, Google may set cookies as part of its authentication flow under Google’s policies.

These are used only to deliver the feature you chose to use.

5. Managing cookies

Because the cookies we set are strictly necessary or preference-based, we do not show an advertising-consent banner. You can still control cookies through your browser: most browsers let you view, delete, and block cookies and clear local storage in their settings. Blocking or deleting our authentication cookies will sign you out and prevent you from using the signed-in parts of the Services. Guidance for common browsers is available in each browser’s help pages.

6. Do Not Track

Because we do not track users across third-party websites, we do not respond differently to browser "Do Not Track" signals. Our use of cookies is limited to operating the Services as described above.

7. Changes to this policy

If we begin using new categories of cookies — for example, analytics — we will update this policy, revise the "Last updated" date above, and, where the law requires consent, ask for it before setting non-essential cookies. We encourage you to review this page periodically.

8. Contact us

If you have questions about our use of cookies, email team@coff.app or call +1 (425) 465-1290.