Cookies
Cookie Notice
Effective: 2 August 2026
What this notice covers
This notice explains how Brainloot uses cookies and similar technologies (localStorage, sessionStorage, IndexedDB, and pixel tags) on the Brainloot website and app. It is provided in line with the UK Privacy and Electronic Communications Regulations (PECR) and UK GDPR. For the wider data-processing context, read the Privacy Notice.
How we ask for consent
We do not show a cookie banner. Public marketing pages use cookieless PostHog so we can count pageviews and events without extra marketing cookies. Strictly necessary storage still runs because it is essential to deliver the service. Optional functional and product analytics cookies run only if you opt in on the cookie preferences page or the “Manage cookies” link in the site footer.
Strictly necessary
These run without consent because they are essential to authentication, security, billing, and recording your preferences.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| bl_session | Brainloot - first party (HttpOnly cookie) | Shared sign-in across Brainloot subdomains (app, community, admin). Without it, SSO and protected routes cannot work. | Up to 5 days (rotated on sign-in) |
| Authentication ID token / refresh token | Google Cloud - first party storage | Keeps you signed in in the browser. Without it, the app cannot authenticate requests. | Session and up to 1 year (refresh token rotated server-side) |
| App Check / reCAPTCHA Enterprise attestation | Google Cloud App Check / reCAPTCHA Enterprise | Confirms requests come from the legitimate Brainloot web app to block abuse and bots. | Session |
| Stripe checkout / customer portal cookies (e.g. __stripe_mid, __stripe_sid) | Stripe Payments Europe Ltd. | Required to complete checkout, prevent payment fraud, and operate the customer billing portal. | Session up to 1 year |
| brainloot-consent-v1 (localStorage) | Brainloot - first party | Records your cookie preferences so we don't re-prompt every visit. | Up to 12 months |
Functional
These remember preferences (theme, default workspace, favourite decks) so the app loads in the state you expect. Off by default - you can opt in.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| brainloot-default-workspace, brainloot-favorite-decks-v1-* (localStorage) | Brainloot - first party | Remembers your starred workspace and favourited decks so the app loads where you left off. | Until cleared by you |
| Theme and UI preferences (localStorage) | Brainloot - first party | Remembers theme, sidebar state, and display preferences. | Until cleared by you |
Analytics
With your consent we use PostHog (EU Cloud), Firebase Analytics, and first-party attribution cookies to understand reliability, feature adoption, and how visitors reach Brainloot. We do not use these for behavioural advertising or to build cross-site advertising profiles. Off by default - you can opt in.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| PostHog identifiers (e.g. ph_*, distinct_id) | PostHog, Inc. (EU Cloud) | Aggregate product analytics: page views, navigation, feature adoption, and error diagnostics. Enabled only with your consent. Not used for behavioural advertising. | Up to 1 year (per PostHog defaults) |
| Firebase Analytics / Google Analytics for Firebase (e.g. _ga, _gid, Firebase measurement) | Google LLC / Google Ireland | Aggregate page views and reliability metrics on the website and app. Enabled only with your consent. Not used by Brainloot for behavioural advertising. | Up to 2 years (per Google Analytics defaults) |
| brainloot.attribution.v1, brainloot.marketing.anon.v1 | Brainloot - first party | First-touch UTM / referrer attribution and an anonymous marketing visitor id so we can understand how people find Brainloot. Set only when analytics consent is granted. | 30 days (attribution) / up to 1 year (anon id) |
Cookieless website measurement
On our public website pages we also measure aggregate traffic using PostHog (EU Cloud) in cookieless mode. This places nothing on your device - no cookies, no localStorage, and no persistent identifier - so it does not require consent under PECR. It records page views, the referring site, device type, and approximate (city-level) location, and estimates unique visitors using a short-lived hash computed on PostHog’s EU servers that rotates daily and cannot be linked back to you. It is never used for advertising and cannot identify you across visits or sites.
Third-party services you choose to use
Stripe sets its own cookies during checkout and the customer portal - these are essential to billing and fraud prevention; if you block them, payments will not work. Atlassian (Trello) sets its own cookies only when you initiate a Trello board import. Each provider operates under its own cookie notice.
Browser controls
You can also clear or block cookies and storage in your browser settings. Blocking strictly necessary storage will prevent Brainloot from working. Where you have opted out of analytics, we do not load the consent-gated analytics scripts at all; cookieless website measurement stores nothing on your device either way.
Contact
Cookie or privacy questions: privacy@brainloot.io.