Cookie Policy
Which cookies CatchBack sets, why each one exists, and why there is no banner asking you about them.
Last updated:
In plain English
- Every cookie we set today is one the Service cannot run without: staying signed in, and protecting the sign-in and connector flows from cross-site attacks.
- We set no advertising cookies, run no ad-network pixels, and have no analytics or session-recording tools installed.
- Because nothing we set is optional, there is currently no consent banner to click and nothing to opt out of.
- Cookies never touch the customer and job records you connect. Those are covered by the Privacy Policy.
- One cookie is a convenience rather than a necessity — it remembers whether your dashboard sidebar is open.
2. What we set, and why
This is the complete list. It is short because the Service does very little in the browser that requires remembering anything.
| Cookie | What it does | Category | Life |
|---|---|---|---|
| better-auth.session_token | Keeps you signed in and links each request to your account. | Strictly necessary | 7 days |
| better-auth.session_data | A short-lived cache of your session so every page load does not hit the database. | Strictly necessary | 5 minutes |
| Sign-in flow cookies (better-auth) | Hold the one-time state and PKCE values that prove a Google sign-in came back to us from the browser that started it. Deleted as soon as the sign-in completes. | Strictly necessary | Minutes |
| catchback.connector_oauth | The same protection for connecting a Google Sheet, OneDrive file or Gmail account. Scoped to the connector routes only. | Strictly necessary | 10 minutes |
| sidebar:state | Remembers whether you left the dashboard sidebar open or collapsed. Set only inside the dashboard. | Functional | 7 days |
Strictly necessary
These cannot be switched off. Without the session cookies you cannot stay signed in, and without the flow cookies we cannot tell a real sign-in or connector authorisation from a forged one — so blocking them does not degrade the Service, it stops it working.
Functional
One cookie, and it only remembers whether your dashboard sidebar is open. Blocking it costs you nothing except that the sidebar returns to its default on each visit.
3. What we do not set
Stated as plainly as we can, because the absence is the point:
- No advertising or cross-site tracking cookies. We run no ad-network pixels and take part in no advertising exchange.
- No analytics cookies. We have no product-analytics, heatmap or session-recording tool installed. We do keep ordinary server logs, which are not cookies and are described in the Privacy Policy.
- No third-party cookies from our payment processor. Checkout is hosted by Stripe on Stripe’s own domain: you leave catchback.ai, pay, and come back. Any cookie Stripe sets is set there, under Stripe’s policy, not ours.
If any of this changes we will update this policy first, and where consent is required we will ask for it before setting anything.
4. Cookies and the data you connect
Cookies operate on your browser session. They do not read, transmit or index the customer and job records you upload or connect. Those records are governed by our Privacy Policy and our Terms of Service, which commit that your data is not sold, not used to promote anything to your customers, not used for another account, and not used to train AI models.
5. Your choices
There is no banner, because there is nothing to consent to
Consent banners exist to ask about optional cookies. We do not set any that carry you between sites or build a profile, so we do not ask. If we ever add analytics or anything else non-essential, a consent control will appear here and in the footer before that cookie is set — not after.
Your browser
You can block or delete cookies in your browser settings, and you can do it per site. Blocking ours will break sign-in and the connector flows, and the Service will not function while they are blocked.
Global Privacy Control and Do Not Track
We do not sell or share personal information, and we set no advertising cookies, so a GPC or DNT signal has nothing to switch off here. We are not relying on those signals being absent: the practice they object to is one we do not carry out.
6. Legal basis
In the EEA and UK we rely on the strictly-necessary exemption for the session and flow cookies above, and we would take consent before setting anything outside it.
In the US we operate on a notice basis. Because we do not sell or share personal information for cross-context behavioural advertising, there is no advertising opt-out for us to offer.
7. Changes to this policy
We will update this policy as the Service changes. Material changes will be announced on the site, and where consent becomes required we will ask for it rather than assume it. The “Last updated” date at the top of this page always reflects the current version.
8. How to contact us
Questions about cookies or privacy: email hello@catchback.ai, or use our contact page.
Vixo Life LLC, Massachusetts, United States.