Cookie policy.
thesweetnote.com, the brand-facing dashboard, and the recipient-facing reveal page. The marketing site loads no third-party analytics scripts at launch. The dashboard uses only essential sign-in storage (Supabase Auth’s session and SweetNote’s own session ticket), functional values that stay on the operator’s device and, on the payment page only, the payment processor’s own fraud-prevention cookies (Section 2). The reveal page uses a non-blocking consent ribbon and action-as-consent for engagement events (see Section 3).
1. Marketing site (thesweetnote.com)
The public marketing site (thesweetnote.com) loads no third-party analytics or tracking scripts (no Google Analytics, no Meta Pixel, no Pinterest tag, no Google Tag Manager, etc.) and sets no advertising, retargeting, or behavioral-targeting cookies under any condition. Aggregate visitor counts, when needed, are derived from server-side request logs only.
The marketing site sets no advertising, analytics, or tracking storage of any kind, and there is no cookie banner because there is nothing of that kind to consent to. It does set the strictly-necessary or functional first-party values listed below:
| Cookie | Category | Purpose | Lifetime |
|---|---|---|---|
sn_gate | Strictly Necessary | Set only during the invite-only private preview. Remembers that you entered the preview password so you are not re-prompted on every page. First-party, HttpOnly, Secure, SameSite=Lax; no analytics or tracking value. Not set once the site opens to the public. | 30 days |
sn_pricing_scoping | Functional | Browser localStorage, not a cookie. Set only if you use the pricing calculator, and only to carry the study parameters you entered (methodology, recipient count, number of variations) into the campaign wizard so you do not have to re-enter them. First-party; contains no identifier, no personal data, and no analytics or tracking value; never transmitted to a third party. Cleared with your browser storage at any time. | Until cleared |
sn-anim-paused | Functional (accessibility) | Browser localStorage, not a cookie. Set only if you use the “pause animation” control on a page that carries one, and only to remember that you prefer motion paused so the preference survives navigation between pages. First-party; contains no identifier, no personal data, and no analytics or tracking value; never transmitted to a third party. Removed when you turn the preference back off, and cleared with your browser storage at any time. | Until cleared |
sn_terms_pending | Strictly Necessary | Browser localStorage, not a cookie. Set only on the sign-in page, and only when you tick the box agreeing to the Terms of Service and ask for a sign-in link or code to create an account (a Google or Microsoft sign-up sets nothing here; you confirm on the next page instead). It carries that agreement to the page that finishes your sign-in in the same browser, so we can record it against your account. It holds the Terms of Service version, the time you ticked the box, and the email address you entered. First-party; never transmitted to a third party. It is removed when the sign-in finishes, when the sign-in page is opened or returned to with the back or forward button, and when you choose “Start over”; if none of that happens it stays in your browser but is ignored after 15 minutes. Cleared with your browser storage at any time. | Used for 15 minutes at most |
sn_login_bounce | Strictly Necessary | Browser sessionStorage, not a cookie. Set only on the sign-in page. Counts sign-in redirects so a broken session cannot loop. First-party; contains no identifier. | Until the tab is closed |
| Supabase Auth session and code verifier | Strictly Necessary | Set on the sign-in page when you sign in or ask for a sign-in link or code; described in the dashboard table below. | Until sign-out |
If you are a logged-in operator viewing the dashboard, the dashboard sets the additional values described in Section 2.
Because the marketing site loads no third-party analytics, advertising, or tracking technologies, and the first-party values above are strictly necessary or purely functional (they carry your own inputs and preferences between pages; the only one that holds an identifier, sn_terms_pending, holds the email address you just typed to create an account, for at most 15 minutes, only to complete that sign-up), no consent banner is required under the ePrivacy Directive Art 5(3) or analogous law.
2. Brand-facing dashboard
When Customer's operators sign in to the SweetNote dashboard, the following essential and functional cookies and equivalent storage values are set. The two sb- session tokens are set by Supabase Auth (SweetNote's authentication subprocessor); the rest are first-party values set by the dashboard itself and stay on the operator's own device:
| Cookie / storage value | Category | Purpose | Lifetime |
|---|---|---|---|
sb-<project>-auth-token (Supabase Auth) | Strictly Necessary | Browser localStorage, not a cookie. Holds the signed-in session: a 1-hour access token, refreshed automatically, and a single-use rotating refresh token. Set by Supabase Auth on SweetNote’s own origin. A companion -code-verifier value is held briefly while a sign-in link or code is pending. Removed on sign-out; signing out also revokes the refresh token on the server. | Until sign-out (no fixed session limit) |
sn_session (first-party) | Strictly Necessary | Signed session ticket that admits your browser to the gated dashboard at the edge once you have authenticated; cleared on sign-out. HTTP-only, Secure, SameSite=Lax. Carries only an opaque user identifier and an expiry, no profile data. | 24 hours (renewed on sign-in) |
__stripe_mid, __stripe_sid (third-party, set by Stripe) | Strictly Necessary | Set by Stripe’s payment script (js.stripe.com), which loads on the dashboard’s payment page only, where the card checkout is embedded. Stripe, SweetNote’s payment sub-processor, uses them for fraud prevention on the payment itself; SweetNote reads neither. The script loads on no other page and never on the recipient-facing reveal. Names and lifetimes are as Stripe documents them. | About one year (__stripe_mid); about 30 minutes (__stripe_sid) |
swn_logo_* (first-party) | Functional | Holds a logo image you upload while previewing a reveal in the campaign builder, so the preview can render it before the campaign is saved. Stored in sessionStorage on your own device; never sent to a recipient and never set on the recipient-facing reveal page. | Until the browser tab is closed |
sn_* / sn:* workspace UI state (first-party) | Functional | Browser localStorage and sessionStorage, not cookies. The dashboard keeps your own working state on your own device so the interface behaves predictably between visits — for example unsaved campaign-wizard drafts and saved audiences (sn_campaign_drafts, sn_audiences), recently-viewed items (sn-portal-recents), first-scan and shipped acknowledgements (sn:firstscan:*, sn:shipped:*), dismissed prompts (sn_firmo_prompt_dismissed:*), your workspace profile for display (sn_brand_profile), API-key labels you have created (sn_api_keys), and one-time hand-off and notice markers (sn_pay_handoff, sn_rbac_redirect_toast). All first-party, all confined to the signed-in operator’s own browser, none containing recipient Personal Data, and none used for analytics, advertising, profiling, or tracking across sites. Cleared with your browser storage, or by signing out and clearing site data. | Until cleared |
The dashboard sets no advertising, analytics, or tracking cookies beyond those above. There is no third-party analytics provider (e.g., Google Analytics, PostHog, Plausible) loaded on the dashboard at launch, if and when a product-analytics provider is added in a future phase, Customers will receive at least 30 days' written notice at the email on file before activation; this policy will be updated in tandem. For clarity: the dashboard and the sign-in page use Sentry for application error monitoring (crash reporting), which is not analytics or advertising — the script is served from SweetNote’s own origin, sets no cookies and no persistent storage, transmits nothing except when an error occurs, and error events are scrubbed of personal data before transmission (see the Sub-processors page). The recipient-facing reveal page does not load Sentry.
3. Recipient-facing reveal page
The reveal page does not gate the recipient’s message behind a consent decision. The video, the sender’s written note, and the brand’s call-to-action are visible from the moment the page loads — the recipient taps a poster button to start the video, an act of their own intent. Analytics consent is requested separately on a small, non-blocking ribbon, and may be answered, ignored, or revisited at any time. This design satisfies freely-given consent under the EU General Data Protection Regulation (Recital 42, Article 7(4)) and the European Data Protection Board’s Guidelines 5/2020 prohibition on cookie walls; declining analytics never withholds the message itself.
The following minimal cookies and equivalent device-storage items may be set, in the situations described in the right-most column:
| Cookie / storage value | Category | Purpose | Lifetime | Set when |
|---|---|---|---|---|
sn_consent | Audit (Performance) | Stores the recipient’s consent decision, the version of the consent text shown, the region tag, and the Global Privacy Control signal value at the moment of decision. Set only after the recipient makes an affirmative decision; used to honor that decision on subsequent visits, to satisfy the consent audit trail described in the DPA, and to compute an aggregate opt-in rate reported to the sending organization at a 25-recipient floor (no individual decision is shared). Not Strictly Necessary — a recipient who never makes a consent decision never gets this cookie. | 5 years (audit retention; can be revisited at any time via the “Privacy choices” link in the reveal-page footer) | Only on an affirmative decision — either a tap on the consent ribbon’s Count me in/Not this time button, or a recipient action that is itself the consent (tapping a reaction or following the brand’s call-to-action, see Section 5 of the privacy notice). Not set when the recipient ignores the ribbon. |
The events that may be captured fall into three groups, each with a distinct lawful basis:
- Strictly necessary · no consent required. Server-side rendering of the reveal page, session-token issuance, abuse-prevention logging (IP, User-Agent), the server-side record that a reveal was opened (the scan, the time it was opened, and any re-opens), the record that the recipient pressed play (the video-start event), and how long the reveal page was open and in front of the recipient (the time-on-page record behind the aggregate Dwell metric) are processed under Customer’s legitimate-interest basis. These records are captured for every recipient regardless of the consent choice — they power the aggregate Reach, Engagement (pressed play), Speed, Rescanned, and Dwell metrics, carry no name (only a pseudonymous token, name-link purged 30 days after the window closes), and are reported only in aggregate at a 25-recipient floor. The time-on-page record measures the page, not the video: it carries two durations, the time the reveal was actually in the foreground (which is what the Dwell metric reads) and the total time the page stayed open including time in the background; it is held in memory and sent each time the page moves to the background and once more as it closes; stores nothing on the recipient’s device, and observes nothing about what was watched. Server logs (IP/User-Agent) are kept for the period in Section 6 of the privacy notice (up to 45 days; hosting and database logs 7 days or less).
- Watch-depth measurement · consent required. Continuous measurement of how far through the video a recipient watches — video progress thresholds (at each 10% of playback), video completion (≥85% watched), and the retention curve — fires only after the recipient taps Count me in on the consent ribbon. It is suppressed entirely when the recipient declines, ignores the ribbon, or sends a Global Privacy Control signal. Pressing play itself is not gated, and neither is the time-on-page record (both are captured for every recipient under the previous bullet); only the watch-through measurement described here — how far into the video the recipient got — requires opt-in.
- Action-as-consent events. Tapping one of the three reactions or following the brand’s call-to-action is an affirmative act under GDPR Article 4(11) and creates the consent record at that moment. The reaction and the CTA-click event fire only when the recipient performs the act. If the recipient has already declined on the ribbon, a later tap does not quietly opt them back in: the reaction and CTA-click events stay suppressed, and the ribbon is re-offered so the recipient can change their mind deliberately. A refusal is not overridden by an unrelated affirmative act (GDPR Art 7(3)). A separate
consent_decisionaudit record is written alongside the first such action so the order of events is unambiguous in the log.
The reveal page sets no advertising, retargeting, behavioral-targeting, or cross-site cookies under any condition, and loads no third-party scripts that set cookies (Meta Pixel, Google Tag Manager, LinkedIn Insight, TikTok Pixel, and similar). Recipients on browsers that send the Global Privacy Control signal (navigator.globalPrivacyControl === true) are honored as a hard opt-out: the consent ribbon is hidden, and the watch-depth measurement, the pressed-play and time-on-page records, and all action-as-consent events are suppressed. Only the server-side record that the reveal was opened is kept, together with a consent record noting that the GPC signal was honored. Nothing is written to the device. Being captured under legitimate interest does not exempt a record from Global Privacy Control: the time-on-page record is suppressed for a Global Privacy Control recipient even though it requires no opt-in from anyone else.
If Customer has enabled Outcome Attribution and uses the Click-token path, SweetNote appends a signed sn_ref token to the call-to-action link the recipient follows; Customer’s own conversion page carries that token through, and Customer’s server forwards it with the conversion event. SweetNote sets nothing on Customer’s domain, and nothing on the recipient’s device, for this purpose. Where Customer chooses to persist the token between page loads on Customer’s own site, that storage is Customer’s own, set by Customer, and governed by Customer’s privacy notice and cookie disclosure. See the DPA Outcome Attribution Schedule §10.
4. Third-party content (fonts, CDN libraries, and video playback)
The recipient-facing reveal page contacts no third party other than SweetNote’s own sub-processors. Its typography — including the full 34-face palette the per-tenant Reveal Design system selects from — is self-hosted by SweetNote and served from SweetNote's own domain, as is its video player (hls.js). It loads no fonts, scripts, or libraries from any content-delivery network. Nothing about a recipient, including their IP address, reaches Google or any advertising, analytics, or tracking company at any point.
When the recipient presses play, the video streams from Mux. Mux is SweetNote's video sub-processor: it is listed on the Sub-processors page, engaged under a written data-processing agreement, and acts only on SweetNote's instructions. It is disclosed here because a recipient's browser does contact it, which is the test this section applies — not because it sits outside the disclosed processing chain. The playback request carries the standard technical metadata any video request carries (IP address, user agent) over a short-lived signed URL. Mux receives no recipient name and no engagement record, and SweetNote has configured Mux so that no automated biometric analysis runs on Customer videos. When the reveal opens, the still frame behind the play button is loaded from Mux (image.mux.com) over a short-lived signed URL, so the recipient’s browser contacts Mux on open; the video stream follows only on press-play. If the brand has uploaded a logo, it is loaded from SweetNote’s storage on Supabase, also a listed sub-processor.
The other two surfaces — the public marketing site and the brand-facing dashboard, both used by Customer's own staff rather than by recipients — load typography from Google Fonts (fonts.googleapis.com / fonts.gstatic.com): primarily Inter for UI and JetBrains Mono for code. This is a static CSS-and-font-file request, not a script.
No Google Analytics, Google Tag Manager, advertising tags, or behavioral-tracking technology is loaded alongside the font request on any SweetNote surface. On the two staff-facing surfaces the HTTP request to Google does, however, transmit the standard request metadata of any cross-origin web request: IP address, User-Agent, and Referer header. That metadata belongs to Customer's own staff, not to recipients — no such request is made from the reveal page. Google's published commitments for Google Fonts state that requests are logged for security and abuse-prevention purposes only and are not used for advertising or to build user profiles (see developers.google.com/fonts/faq).
Procurement teams that scrutinise third-party requests. Where it matters most — the surface a recipient actually opens — the hardening is already the default and needs no request: reveal typography and the video player are both self-hosted, so a reveal loads nothing from Google, from any asset CDN, or from any advertising or analytics provider. Stated precisely, so that a network trace matches this page: a reveal that is opened contacts Mux for the signed still frame (and Supabase Storage for the brand logo, if one is set); a reveal that is played also streams the video from Mux, SweetNote's video sub-processor. A posture sometimes adopted post-Schrems II. If a Customer also needs the two staff-facing surfaces free of the Google Fonts request, SweetNote can self-host those fonts on the Customer's brand subdomain on request to legal@thesweetnote.com. This is configured per-Customer and does not change the substantive terms of this policy.
The sign-in page, the brand dashboard and the report-export feature load four open-source JavaScript libraries (supabase-js, ExcelJS, qrcode-generator and html2canvas-pro) from the jsDelivr CDN (cdn.jsdelivr.net). These are static code files; no recipient or Customer Personal Data is sent to the CDN. The recipient-facing reveal page loads no CDN library and no third-party script of any kind: it plays Mux video using the hls.js library served from SweetNote's own origin (self-hosted, not fetched from any CDN), and its typography is self-hosted as described above. The video stream itself is delivered by Mux on press-play, as described earlier in this section. On request to legal@thesweetnote.com, SweetNote can self-host these libraries to remove the cross-origin request.
Two further third-party loads, both from disclosed sub-processors: the dashboard’s payment page loads Stripe’s payment script from js.stripe.com (the cookies it sets are listed in Section 2), and the public Gift Lift Study page embeds a video player served by Mux from player.mux.com, which receives the standard technical metadata of a video request (IP address, user agent). SweetNote passes it nothing about the visitor; what the player stores inside its own origin is governed by Mux’s notice.
5. Opt-out and recipient rights
Recipients can revisit their decision at any time via the “Privacy choices” link in the reveal-page footer, which re-opens the consent ribbon. A withdrawal propagates to downstream pipelines as soon as technically feasible and in any event within 24 hours; the consent record itself is retained per Section 3 above for audit purposes, and after a withdrawal no further watch-depth, reaction or call-to-action events are captured; the open, pressed-play and time-on-page records continue under the legitimate-interest basis in Section 3.
Browser-level opt-out is honored on every SweetNote surface: the marketing site, the brand dashboard, and the reveal page each respect the Global Privacy Control (GPC) signal where present. Recipients can also clear cookies through their browser settings at any time.
Where an organization sends recipients from the QR code straight to its own web page instead of a SweetNote reveal page, the forwarding step sets no cookie and stores nothing on the device; any cookies on the organization’s own page are that organization’s, under its own policy.
6. Changes to this policy
SweetNote may update this policy where required to comply with applicable law or to reflect changes in the cookies set. Substantive changes are communicated to active Customers; the canonical version is published at thesweetnote.com/legal/cookie-policy.
7. Contact
Questions about this policy: legal@thesweetnote.com.