Cookie notice

Why this notice is needed

Scrollsmith uses strictly necessary website cookies to provide account authentication and security. The browser extension also uses Chrome extension storage, which is separate from website cookies.

Strictly necessary cookies

Purpose	Information	Duration
Authentication and session refresh	Opaque Supabase session values stored in secure, HttpOnly cookies. JavaScript on the page cannot read HttpOnly values.	Session or provider-configured expiration; refreshed when needed to maintain a valid session.
Security and request integrity	Values needed to complete sign-in, verification, password reset, and related security flows.	Short-lived or session-based, depending on the flow.

These cookies use Secure attributes in production, SameSite=Lax, and the website path. Blocking them may prevent account creation, login, password reset, billing management, and Premium entitlement verification.

Analytics and advertising

Public marketing and policy pages use Vercel Web Analytics for anonymous aggregate page-view statistics. This integration does not use third-party analytics cookies. Scrollsmith removes query strings and URL fragments, excludes account and authentication routes, and does not initialize analytics when the browser sends a supported Do Not Track or Global Privacy Control signal.

Scrollsmith does not use advertising cookies, cross-site behavioral tracking, or custom analytics events. If optional analytics, personalization, or marketing cookies are added later, we will update this Notice and provide a consent control where required before activating them.

Stripe, Supabase, and hosting providers

When you use hosted checkout, authentication, or other provider-controlled pages, Stripe, Supabase, Vercel, or another selected host may set their own cookies under their respective notices. Review Stripe's Privacy Policy, Supabase's Privacy Policy, and Vercel's Privacy Notice.

Extension storage is not a cookie

The extension stores theme choices, size and color settings, enabled state, disabled hostnames, per-site presets, and opaque session credentials using Chrome extension storage. Websites cannot use this storage as their own cookie jar. See the Extension Privacy Disclosure.

Your controls

You can delete or block website cookies through browser settings, but essential account features may stop working. You can clear extension settings through the extension or remove the extension. Stripe and other providers may offer separate cookie controls on their sites.

Contact

Questions: hello@usescrollsmith.com
Individual owner of Scrollsmith · usescrollsmith.com