1. What cookies are
Cookies and similar browser storage help websites remember state, keep users signed in, protect sessions and improve product reliability.
2. Cookies and storage we use
The table lists each cookie or browser store by name, what it is for, whether it is strictly necessary, a preference, or analytics, how long it lasts, and who receives it. Strictly necessary storage is used to sign you in, keep the service secure, and remember a choice you made. Analytics storage is written only after you accept.
The free-tool device id (pp-lead-device) lasts 24 hours, the same length as the daily abuse limit. It does not need to last longer than that window.
Email and password sign-up can load Cloudflare Turnstile when that check is switched on. Turnstile is strictly necessary security. It does not wait for analytics consent, it is not used for advertising, and Google or GitHub sign-in does not load it. When the check is off, the script is not added.
| Name | Purpose | Type | Lifetime | Party |
|---|---|---|---|---|
| sb-<project-ref>-auth-token | Signs you in. Large sessions are split into .0, .1, and so on. During sign-in, sb-<project-ref>-auth-token-code-verifier holds the PKCE check and is then removed. | Strictly necessary | 400 days, removed when you sign out | First party. Supabase Auth processes the session. |
| pp_analytics_consent | Stores whether you accepted or rejected analytics, so the banner does not ask again. | Strictly necessary | 1 year | First party |
| pp-lead-device | HttpOnly random id for the daily abuse limit on the free tools. It is not a hardware fingerprint and it does not identify a signed-in account. It lasts one day, the same length as that limit. | Strictly necessary | 24 hours | First party |
| pp-lead-brand, pp-lead-logo, pp-lead-palette, pp-lead-cv-profile, pp-lead-signature, pp-lead-card | HttpOnly cookies that keep an in-progress free-tool draft in this browser (brand check, logo, palette, CV, signature or card) so the tool can resume. | Strictly necessary | 2 hours | First party |
| pp-lead-cv-apps | HttpOnly count of free CV applications from this browser. It stores a number, not the CV, so the third application is the end of the free run. | Strictly necessary | 180 days | First party |
| preferred-locale | The language you chose for the signed-in app. Marketing pages stay in English and ignore it. | Preference | 1 year | First party |
| theme (localStorage) | Light, dark, or system appearance. Stored in this browser only, not sent as a cookie. | Preference | Until you clear site data | First party, on this device |
| pp:left-dock-pinned (localStorage) | Whether you keep the app navigation dock open. Stored in this browser only. | Preference | Until you clear site data | First party, on this device |
| pp_active_tenant_id | HttpOnly id of the workspace you last had open, so the next visit opens the same one. | Strictly necessary | 400 days | First party |
| marshi-face | Which Marshi face you picked in settings. | Preference | 1 year | First party |
| billing-currency | Which currency the pricing pages show. | Preference | 1 year | First party |
| pp_overview_scope | HttpOnly flag for whether the project list is showing every project or one project. | Preference | 1 year | First party |
| pp-plan-intent | HttpOnly note of the plan you chose on the pricing page, until signup finishes. It does not start a payment. | Strictly necessary | 7 days | First party |
| pp-ask-marshi | HttpOnly flag that you chose Ask Marshi on the marketing site, until that question is waiting in chat. | Strictly necessary | 7 days | First party |
| pp_auth_recovery_pending | HttpOnly flag so a password reset finishes before the rest of the app opens. | Strictly necessary | 15 minutes | First party |
| ph_* (cookie and localStorage) | Product analytics. Also ph_* in sessionStorage for the tab. After you reject, an opt-out flag (__ph_opt_in_out_*) may stay in localStorage so PostHog remains off. Nothing here is written before you accept. | Analytics | Up to 1 year. Deleted when you reject or withdraw. | PostHog (EU) |
| Vercel Web Analytics and Speed Insights (no cookie) | Page views and performance. The scripts are added only after you accept, and they are removed from the page when you reject or withdraw. | Analytics | Only while analytics consent is on | Vercel |
| Cloudflare Turnstile (no cookie) | Bot check on email and password sign-up, only when that check is switched on. It is strictly necessary security and does not wait for analytics consent. It does not run on Google or GitHub sign-in. When it is off, the script is not loaded. Marshi does not set a cookie for it. | Strictly necessary | Not stored as a cookie. The check runs during sign-up. | Cloudflare |
| Sentry error reports (no cookie) | Browser error reports so the service you asked for can be kept working. No cookie, no session replay, and no performance tracing. Messages are scrubbed before they are sent. | Strictly necessary | Sent when an error occurs. Not stored as a cookie. | Sentry |
| Sentry tracing and session replay (no persistent cookie) | Performance traces and, where replay is switched on in production, a session replay. Neither runs unless you have accepted analytics. Tracing is sampled at 0 without that consent. Replay is not loaded without it. | Analytics | Only while analytics consent is on | Sentry |
3. Cookie choices
When you first visit Marshi, a banner lets you accept or reject non-essential analytics. Strictly necessary cookies are always used so sign-in, security and core product flows continue to work.
You can change that choice at any time. Cookie settings, in the site footer and in the account menu, opens the banner again. Rejecting analytics there withdraws an earlier acceptance.
On reject or withdrawal, PostHog is opted out and reset, and its ph_* cookies and local storage are deleted. Vercel Web Analytics and Speed Insights are removed from the page. Sentry performance tracing stops, and session replay is not loaded. Rejecting analytics does not turn off essential error reports, which use no cookie and are limited to what is needed to keep the service working. It also does not turn off Cloudflare Turnstile on email sign-up, when that check is switched on.
For active workspace users, limited server-side product telemetry may still occur to operate the service under our contract with your organisation. See the Privacy Policy for more detail.
4. Third-party services
Marshi may rely on providers such as Vercel, Supabase, Stripe, Resend, OpenAI, Sentry, PostHog and, when email sign-up protection is switched on, Cloudflare. These services may set or process technical signals when their functionality is used, for example authentication, billing, email delivery or AI tasks.
5. Managing cookies
You can control cookies through your browser settings. Blocking strictly necessary cookies may prevent login, workspace access or security flows from working correctly.
To change analytics consent without clearing site data, use .
6. Related privacy information
For more detail about how Marshi processes data, see the Privacy Policy. Questions can be sent to support@marshi.ai.
