Cookie Policy

Short version: ReplyTide uses cookies needed for sessions, security and requested workflows, plus one cookie that remembers the language you select. We do not use advertising cookies, cross-site trackers or third-party analytics cookies.

1. What cookies are

Cookies are small text files a website stores in your browser so it can remember things between page loads — like the fact that you're signed in.

2. The cookies we set

• session_creator_id — identifies your signed-in channel session. In production, the browser value is an opaque random token whose protected hash and session details are kept in server-side storage (HttpOnly, SameSite=Lax, Secure). Essential for the dashboard to work.
• session_account_id — identifies your Google account session when you manage multiple channels. In production, the browser value is an opaque random token backed by server-side session storage (HttpOnly, SameSite=Lax, Secure).
• oauth_state (named __Host-oauth_state in HTTPS production) — a short-lived, HttpOnly random nonce used to match the Google OAuth callback and prevent cross-site request forgery. It is not a signed payload and expires after 10 minutes or is deleted on callback.
• oauth_pkce (named __Host-oauth_pkce in HTTPS production) — a short-lived, HttpOnly random PKCE code verifier that binds the Google authorization code to the browser that started sign-in. It is not a signed payload and expires after 10 minutes or is deleted on callback.
• legal_acceptance (named __Host-legal_acceptance in HTTPS production) — a 10-minute, HttpOnly signed payload recording a pending Terms and Privacy acceptance while sign-in proceeds.
• resource_download — a short-lived, HttpOnly signed payload used to authorize a requested campaign resource download without placing its access token in browser history.
• viewer_privacy_delete_confirmation — a short-lived, path-restricted HttpOnly signed payload used to authorize the final step of a verified viewer-deletion request.
• replytide_lang — remembers your language preference for one year. It is readable by the page so the interface can switch languages and uses SameSite=Lax; it does not identify a signed-in account.
• connect.sid — an isolated administrative session identifier used only by the separate private admin dashboard and backed by server-side session storage (HttpOnly, SameSite=Strict, Secure in production, one-day maximum lifetime).

The session, OAuth, workflow and private-admin cookies are necessary for the corresponding requested features to work securely. The language cookie is created when you choose a language and is used only to remember that choice.

3. Third-party cookies

When you sign in with Google, Google sets its own cookies on its own domains as part of the OAuth flow — that's governed by the Google Privacy Policy, not by us. We do not embed advertising networks, social widgets, or third-party analytics scripts that set cookies on our pages.

4. Managing cookies

You can block or delete cookies in your browser settings at any time. The public site (this page, the homepage, the blog) works fine without cookies; the signed-in dashboard requires the session cookies above to function.

5. Changes

If we ever add cookies beyond the strictly necessary ones listed here — for example, analytics — we will update this page first and, where the law requires it, ask for your consent before setting them.

6. Contact

Questions about cookies: Privacy Officer, Radhe Software Solutions (privacy@replytide.co).