Cookie Policy

Cookies are small text files stored on your device. We also use comparable client-side storage — localStorage and sessionStorage — for the same purposes. This page covers all of those mechanisms and names them one by one.

The version of 13 August 2026 is an inventory re-read against the code, not a rollover. It removes two entries that described cookies which do not exist, corrects the name of the session cookie, puts right the storage mechanism behind the consent choice, and adds what was missing: error monitoring and display preferences. It also brings this page into line with section 3 of the Privacy Policy, whose description of server-side usage measurement it contradicted.

Two cookies fall into this category, both first-party. They are required for the service to function and cannot be turned off. They carry no advertising identifier. They are the only cookies set for as long as you have not accepted analytics.

sb-<project-ref>-auth-token (first-party, Supabase)

The authenticated session cookie. There is only one: our Supabase project reference is inserted into its name, and your browser may see it split into numbered chunks (".0", ".1") when its value exceeds the maximum size of a cookie. It is set at sign-in, removed at sign-out, and its lifetime is the one set by our project's authentication configuration — it is not a parameter of this document.

skeldy_plan_choice (first-party)

Carries the plan you picked on the pricing page through to the creation of your organisation — a journey the page address does not survive. Inaccessible to JavaScript, 30-minute lifetime, consumed and cleared as soon as it has served. It is only set if you reach sign-up from the pricing page.

To these are added six local-storage entries. They are not cookies: they never travel to our servers and they stay in your browser. None of them carries an expiry date — they disappear when you clear the site's data; the last one holds a timestamp we stop taking into account after seven days, without the entry itself being removed. They record a preference you expressed yourself, which is why they require no prior consent.

skeldy_consent (localStorage)

Your choice on this page or in the banner, recorded as the value "granted" or "essential", so that you are not asked again on every visit. Contrary to what earlier versions announced, this is not a 12-month cookie: it is a local-storage entry with no expiry. Clearing the site's data removes it and the banner reappears.

skeldy:theme (localStorage)

The light or dark theme you selected. Read before the page's first render so that it does not flash.

skeldy:density (localStorage)

The display density of the schedule grid, comfortable or compact.

skeldy:onboarding-seen (localStorage)

Remembers that you dismissed the first-run banner, so that it is not shown to you again.

skeldy_nudge_dismissed_<feature-key> (localStorage)

Remembers that you dismissed an invitation to move up to a higher plan, and which feature it concerned. The value is the timestamp of your click: we stop taking it into account after seven days, after which the invitation may reappear. One entry per feature concerned, written only if you dismiss the invitation yourself.

skeldy_nudge_shown_session_<feature-key> (sessionStorage)

Prevents the same upgrade prompt from being counted twice within an open tab. Cleared when the tab closes. Written without a consent condition, as it only exists to keep an internal count honest.

This section covers three distinct processing activities. Only one of them depends on your consent, and the distinction matters enough to be stated before the inventory rather than after it.

The first is analytics in your browser, subject to your consent. If you accept, we load PostHog (eu.posthog.com) to understand which features serve managers best and which need work. For as long as you have not accepted, the script is not even downloaded. We never sell or share analytics data with advertisers. Consent can be withdrawn at any time from this page.

ph_<project-key>_posthog (first-party, PostHog EU)

PostHog's state: visitor identifier, session properties, the library's internal flags. Written both as a cookie and in localStorage under the same name. Only set once you have accepted; 12-month expiry for the cookie. Withdrawing your consent stops events being sent; clearing the site's data removes the entry.

ph_<project-key>_window_id and ph_<project-key>_primary_window_exists (sessionStorage, PostHog EU)

Tab correlation, used to tie together the events of a single window. Session storage: cleared when the tab is closed. Same consent lifecycle as the entry above.

The second is server-side usage measurement, and it does not go through this banner. When you are signed in, certain product events — sign-up, completion of onboarding, publication of a schedule, completed import, acceptance of an AI proposal, subscription events — are sent from our servers to PostHog EU, identified by a technical account or organisation identifier. This flow puts nothing in your browser, so it can be neither covered nor blocked by your choice here. It rests on legitimate interest, as section 3 of the Privacy Policy sets out, and you can object to it by writing to [email protected]. Refusing it on this page would be a checkbox with no effect; we do not display one.

The third is error monitoring. Sentry is loaded on every page, regardless of your choice, in order to report application faults, the path that led to them and, on a fraction of page loads, a performance trace. It sets no cookie and writes no entry into your browser's storage, neither persistent nor session. Nor does it record any session replay: the feature is not installed and deliberately stays off, because it would film named schedule grids. Ingestion transits through our own domain, which makes it invisible to a content blocker — all the more reason to write it here. This processing rests on legitimate interest and not on your consent.

Use the cookie banner shown on your first visit, or come back to this page and choose "Update cookie preferences" below. The Do Not Track and Global Privacy Control browser signals are read on load and count as a refusal: when either one is active, the banner is not shown and analytics stays off.

This setting covers browser analytics. The server-side measurement and the error monitoring described in section 3 do not depend on it; objection to the former is exercised in writing to [email protected]. Clearing the site's data in your browser removes your choice along with your display preferences, and the banner reappears on your next visit.

If we add a cookie or a browser analytics tool, we will update this page and ask for fresh consent before activating it. If we add processing based on legitimate interest that sets nothing in your browser, there is no consent to ask for: we then record it in section 3 and in the Privacy Policy, and the effective date at the top of this page changes.