Cookie policy

Cookies are small text files that a website places on your device. They let the site recognize your device and remember things such as whether you are signed in. Similar technologies, such as local storage and session storage in your browser, work in comparable ways. In this policy "cookies" means all of them.

We group what we use into four kinds.

Strictly necessary: needed for the Service to work, for example to keep you signed in. These are always on, and the law does not require your consent for them.

Functional: small settings that make the app work the way you left it, with no tracking.

Analytics: help us understand how the Service is used so we can improve it. These load only if you accept analytics.

Marketing: measure the effect of our campaigns. These load only if you accept marketing.

Strictly necessary
• Sign-in session cookies from our authentication provider Supabase (names starting "sb-"), which keep you signed in
• pp_consent (local storage), which remembers your cookie choice for up to a year
• For PropoBox staff only: the admin panel and maintenance sign-in cookies

Functional
• sidebar_state (cookie, 7 days): whether the dashboard sidebar is open
• Small items in your browser's storage that keep a draft, a dismissed notice or cached site settings, such as pp_public_settings. Most are cleared when you close the tab

Analytics (only if you accept analytics)
• PostHog: product analytics, with cookie and local storage entries starting "ph_". We do not use autocapture, and we link events to your account only while you are signed in
• Microsoft Clarity: heatmaps and session recordings of the signed-in app and our site, with inputs masked, using cookies such as _clck and _clsk
• Google Tag Manager and any Google measurement tags loaded through it, which can set cookies such as _ga
• Sentry Session Replay in the signed-in app, which records the session with all text and inputs masked, using session storage
• Campaign attribution: pp_first_touch and pp_last_touch (local storage), which keep the campaign parameters of the link you arrived on for up to 90 days

Marketing (only if you accept marketing)
We do not currently load advertising pixels. Google Tag Manager runs in Google Consent Mode, where advertising storage stays denied until you accept marketing. If we add advertising pixels, they will load only with your marketing consent and be listed here.

No consent needed: Vercel Web Analytics and Speed Insights measure traffic and page speed without cookies.

Some of these are set by other companies, and we do not control them:

Stripe: payment pages. Stripe may set cookies for fraud prevention and to run checkout. See Stripe's privacy policy.

Google: sign in with Google, and Google Tag Manager. See Google's privacy policy.

Microsoft Clarity: session recordings and heatmaps, with data pseudonymized. See Microsoft's privacy policy.

PostHog: product analytics. See PostHog's privacy policy.

Sentry: error monitoring and session replay. See Sentry's privacy policy.

We suggest you read each provider's policy to see how it handles data.

Session cookies are deleted when you close your browser. Persistent cookies stay for a set time or until you delete them. Sign-in cookies last until you sign out or your session expires. Our own functional cookie lasts 7 days, your cookie choice up to a year, and analytics cookies from one day up to about two years, depending on the provider.

A proposal page belongs to the person who sent it, not to PropoBox. It shows no cookie banner, sets no cookies of its own for the person reading it, and keeps analytics off unless that person has already accepted them on propobox.com in the same browser.

The sender is told when the page is opened and how long it is read. We measure that without cookies, from a one-way hash, as our Privacy Policy explains.

Cookie settings: the first time you visit propobox.com, a banner lets you accept or reject non-essential cookies. You can change your choice at any time with "Cookie settings" in the footer of our site. Rejecting or withdrawing analytics also removes the campaign attribution we kept.

Browser settings: most browsers let you view, block or delete cookies.
• Chrome: Settings, Privacy and security, Cookies and other site data
• Firefox: Settings, Privacy & Security, Cookies and Site Data
• Safari: Settings, Privacy, Manage Website Data
• Edge: Settings, Cookies and site permissions

Opt-out tools:
• Google Analytics opt-out: https://tools.google.com/dlpage/gaoptout
• Your Online Choices (EU): https://www.youronlinechoices.eu
• Network Advertising Initiative: https://optout.networkadvertising.org

Blocking strictly necessary cookies means you cannot sign in or use the app.

Some browsers send a "Do Not Track" signal. There is no common standard for how to read it, so we do not act on it by itself. We honor the choices you make in Cookie settings and with the opt-out tools above.

The Service is for business use and is not directed to children under 16. We do not knowingly use cookies to collect personal data from them. If you believe a child has used the Service, please contact us.

We may update this Cookie Policy when our practices, technology or the law change. The date at the top shows the latest update, and for significant changes we will also tell you in the Service.

If you have questions about cookies or this policy, contact us:

Email: hello@propobox.com
Address: Kodfabrika LLC, 1209 Mountain Road PL NE STE N, Albuquerque, NM 87110, USA

For EU/EEA and UK residents, you also have the right to lodge a complaint with your local data protection authority.