Draft for legal review. This is a thorough outline written by the Capybari team. It has not been reviewed by a qualified solicitor and it is not legal advice. It must be reviewed and approved by a solicitor before launch, and the cookie names and lifetimes below must be verified against the running application. Items marked PLACEHOLDER are not yet confirmed.

Cookie Policy

Last updated 4 August 2026

1. What cookies are

A cookie is a small text file a website asks your browser to store and send back on later requests. Cookies are how a site remembers that you are signed in between one page and the next.

Related technologies do similar jobs by different means. localStorage and sessionStorage keep values in your browser but are never sent to a server. They are not cookies, and we list what we use anyway, because the distinction should not be a way to avoid telling you.

This policy covers capybari.com — the marketing site you are reading now — and the signed-in application. It sits alongside the Privacy Policy, which explains what we do with personal data.

2. What the marketing site does

This marketing site sets no third-party cookies and no advertising cookies. It loads no third-party scripts and no third-party fonts.

There is no analytics tag, no tag manager, no advertising or remarketing pixel, no social media widget, no session recorder, no A/B testing script, no chat widget and no embedded video player. Every stylesheet, script, font and image is served from our own domain. Nothing on these pages contacts another company's servers as you read them, so there is nothing to consent to and no cookie banner.

This is a design decision, not an oversight. If it ever changes, this page changes with it, and we will ask for consent before setting anything that needs it.

We do keep server-side request logs — URL, timestamp, status, referrer, user agent and a truncated IP address — for security and capacity. Those are logs on our own servers, not cookies in your browser. See the Privacy Policy for how long we keep them.

3. The one thing the marketing site stores

The site has a light and dark theme. When you use the theme toggle, we save your choice so the next page does not flash the wrong theme at you.

That choice is stored as a value called capybari-theme in your browser's localStorage. It holds one word — the theme you picked. It is not a cookie, it is never sent to our servers, it contains no identifier, and it cannot be used to recognise you. If you never touch the toggle, nothing is stored and the site follows your operating system's preference.

Clearing site data in your browser removes it. Nothing breaks; the site goes back to following your system preference.

4. Cookies used by the signed-in application

Once you sign in, the application needs cookies to work. These are strictly necessary cookies: they are exempt from the consent requirement under the Privacy and Electronic Communications Regulations, because without them you cannot stay signed in or submit a form safely.

The table below lists them. PLACEHOLDER — the exact cookie names and lifetimes must be verified against the running application before launch.

All application cookies are set with the Secure and HttpOnly flags where the cookie is not read by client-side code, and with SameSite=Lax to limit cross-site use. The application sets no advertising cookies either.

5. How to control cookies

You are in charge of what your browser stores.

Block or delete cookies in your browser settings. Every major browser lets you clear cookies and site data for one site or for all sites, and lets you block third-party cookies entirely.
Use private browsing to have everything discarded when you close the window.
Clear site data for capybari.com to remove the capybari-theme value along with any application cookies.

Blocking cookies on the marketing site costs you nothing except your saved theme preference. Blocking them on the signed-in application will stop you signing in, because there is no other way for the application to know it is still you.

Guidance for each browser is published by its maker: Chrome, Firefox, Safari, Edge.

Browser "do not track" and global privacy control signals are not needed here, since we do not track you across sites, but we will honour them if we ever add anything that would.

6. Changes to this policy

If we add anything that stores or reads data in your browser, we will update this page and the date at the top before it goes live. If the new item is not strictly necessary, we will ask for your consent first and give you a way to withdraw it.

7. Contact

Questions about this policy, or about anything you have found in your browser that is not listed here: privacy@capybari.com.

Everything we store in your browser

The complete list. If you find something on capybari.com that is not on this table, tell us at privacy@capybari.com.

Cookies and browser storage used by the Capybari marketing site and application
Name	Type	Purpose	Duration
`capybari-theme`	First-party `localStorage`. Not a cookie.	Remembers whether you chose the light or dark theme. Holds one word. No identifier, never sent to a server.	Until you clear site data
`capybari_session`	First-party cookie. Strictly necessary.	Keeps you signed in to the application and links your requests to your session. `HttpOnly`, `Secure`, `SameSite=Lax`.	Session, or 30 days if you choose to stay signed in. PLACEHOLDER — confirm
`capybari_csrf`	First-party cookie. Strictly necessary.	Carries a cross-site request forgery token so the application can tell that a form submission came from you.	Session. PLACEHOLDER — confirm

PLACEHOLDER — cookie names, flags and lifetimes must be verified against the running application before launch. No advertising, analytics or third-party cookie appears on this list, on the marketing site or in the application.