This Cookie Policy explains what cookies and similar technologies the Tawa Guard platform uses and why. It should be read together with our Privacy Policy.
1. The short version
Tawa Guard uses strictly-necessary and functional cookies to run the Service, and — only if you opt in — a small set of analytics cookies to help us understand how the product is used. We run no advertising cookies and no cross-site tracking. Strictly-necessary cookies don't require consent under UK and EU law, so there's no banner for those. Analytics cookies do require consent: they stay off until you accept them in the cookie banner, and you can change your mind at any time — see Section 6.
2. Cookies we set
| Cookie | Purpose | Duration |
|---|---|---|
Session cookie (better-auth session token) | Keeps you signed in; identifies your authenticated session | 7 days, refreshed while active; removed on sign-out or expiry |
| Session data cache (encrypted JWE) | Short-lived, encrypted copy of session state that reduces database lookups on every request | ~60 seconds, continuously refreshed while signed in |
| Security state cookies (sign-in flow) | Protect the sign-in flow against cross-site request forgery and fixation | Minutes; removed when sign-in completes |
tawa_cookie_consent | Records your cookie choice | 1 year |
2fa | Sign-in step state while you complete two-factor authentication | 24 hours |
ob | Onboarding state | 24 hours |
pending_invite, pending_join | Completes an invitation or join request after sign-in | 1 hour |
The cookies above are strictly necessary. We also set a few functional cookies that remember interface choices and are not used for tracking:
| Cookie | Purpose | Duration |
|---|---|---|
better-auth.last_used_login_method | Remembers how you last signed in | 30 days |
sidebar_state | Sidebar open or closed | 7 days |
jobs-api-banner-dismissed | Hides a dismissed notice | 30 days |
3. Analytics cookies (optional)
If you accept analytics cookies, we use PostHog to understand how people navigate the product: which pages and features get used, where people drop off during onboarding, and which version of a page or flow performs better when we're testing changes (A/B testing).
| Cookie | Purpose | Duration |
|---|---|---|
ph_* (PostHog) | Anonymous or pseudonymous distinct ID, session and feature-flag state | Up to 1 year |
These cookies are off by default. They're only set after you click "Accept" in the cookie banner, and only in the browser where you accepted them.
4. Strictly-necessary third-party cookies
Some strictly-necessary cookies are set by service providers we use:
| Provider | Cookie(s) | Purpose |
|---|---|---|
| Cloudflare Turnstile | e.g. cf_clearance, __cf_bm | Bot protection on sign-in, sign-up and password reset |
| Stripe | e.g. __stripe_mid, __stripe_sid | Fraud prevention on billing and checkout pages |
| Identity providers (GitHub, Google, Microsoft, GitLab, Hugging Face) | The provider's own cookies | Set by the provider during OAuth sign-in, governed by that provider's privacy policy |
5. Local storage
We use browser local storage (not cookies) for interface preferences such as your theme, onboarding progress, the last app you opened and dismissed notices. This data never leaves your browser.
6. Managing your choice
You can accept or reject analytics cookies at any time from the cookie banner, or by clicking "Manage cookie preferences" at the bottom of this page or in the site footer. Rejecting analytics cookies has no effect on your ability to sign in or use the Service — only strictly-necessary cookies are required for that. You can also block or delete any cookie in your browser settings; blocking strictly-necessary cookies will prevent you from signing in.
7. Changes to this policy
If we introduce new categories of cookies, we will update this policy, notify customers by email, and — where consent is legally required — ask for it before setting them. Continued use of the Service more than 30 days after notice of a change constitutes acceptance of the updated policy.
8. Contact
Questions about this policy: gdpr@tawaguard.com.