Last updated: October 1, 2026
This Cookie Policy explains how Smailor, operated by Victor ANDRE EI, uses cookies and similar technologies, including browser local storage, on the website and in the Service.
1. How we use cookies and similar technologies
We use the following categories:
- Strictly necessary. Authentication, session security, language selection, protection of sign-in and linking flows against cross-site request forgery, and abuse prevention. When enabled, Cloudflare Turnstile may be used in protected flows. It may set cookies or equivalent tokens under Cloudflare's notices; blocking it can prevent the security check from working. Cloudflare also operates as our CDN and may set its own operational cookies under its notices.
- Functional preferences. Theme, language, UI preferences, onboarding progress, and the acknowledgement of the cookie notice. These are mostly held in browser local storage rather than cookies.
- First-party acquisition attribution. If you arrive through a
srcorutm_sourcequery parameter, the Site may set a first-party cookie so that the source can be associated with a later signup. If you arrive through an affiliate or referral link (ref), a first-party cookie records that referral so a commission can be attributed. Neither is a third-party advertising cookie, and neither is used to build an advertising profile. - Analytics and marketing. The current Site does not load third-party analytics or advertising tags. If this changes, we will update this policy and obtain consent before loading non-essential technologies where required by law.
2. Local storage
We use browser local storage for client-side preferences, UI state, onboarding progress, and the cookie-notice acknowledgement. Authentication sessions are held in HTTP-only cookies rather than browser local storage.
Current keys include sm_cookie_consent (cookie-notice acknowledgement), smailor-ob-checklist-v1 and smailor-ob-checklist-done-v1 (onboarding checklist state), smailor-inbox-empty-coach (whether a first-run hint was dismissed), and smailor-ticket-listpanel-filter (your last-used inbox filter). They stay on your device until you clear them and are not transmitted to us as a profile.
3. Your choices
- Your browser lets you block, delete, or limit cookies. Blocking essential cookies can prevent sign-in or other Service features from working.
- The Site currently displays an informational cookie notice and stores an acknowledgement locally. If we add consent-controlled non-essential technologies, the notice will provide the controls required by applicable law.
- If you are in a U.S. state that grants an opt-out of sale or sharing for certain cookies and we are subject to those rules, any additional choices will be described in our Privacy Policy or a U.S. addendum.
4. Current technologies
| Name / type | Party | Purpose | Retention |
|---|---|---|---|
authjs.session-token / __Secure-authjs.session-token |
First party | Authentication and session security (HTTP-only) | Up to 30 days, refreshed while active |
PARAGLIDE_LOCALE |
First party | Language preference | Browser-managed preference cookie |
smailor_src / smailor_src_set (when set) |
First party | Acquisition-source attribution | 90 days |
smailor_ref (when set) |
First party | Affiliate or referral attribution | Duration of the referral window stated in the Affiliate Terms |
google_link_state, gmail_oauth_state, discord_link_state, calendar_oauth_state |
First party | Short-lived state values protecting account-linking and OAuth flows against CSRF | Deleted as soon as the flow completes |
sm_cookie_consent |
Local storage | Cookie-notice acknowledgement | Until cleared by the user |
| Preference and onboarding keys (Section 2) | Local storage | UI state and onboarding progress | Until cleared by the user |
| Turnstile / challenge (when enabled) | Third party (Cloudflare) | Bot and abuse protection | Per Cloudflare's challenge policy |
| CDN and security cookies (when set) | Third party (Cloudflare) | Traffic routing and protection | Per Cloudflare's policy |
Third-party cookies can involve the collection of IP addresses, device identifiers, or other pseudonymous data by vendors under their own policies. Where personal data is transferred outside the EEA or UK, the applicable safeguards are described in our Privacy Policy and DPA where they apply.
5. The embedded widget on customer websites
Our contact widget can be embedded on a customer's own website. Where it stores anything in the visitor's browser, it does so to keep that conversation working across page views — not to advertise or track visitors across sites. The website operator that embeds the widget is the controller for that deployment and is responsible for its own cookie notice, consent, and privacy information. If you met the widget on someone else's site, contact that site's operator first.
6. Email tracking is not a cookie, but it is a similar technology
Mail sent from Smailor may contain a tracking element that reports when a message is opened, where the sender enabled that feature, and mail you receive may contain remote images that try to report the same thing to whoever sent it. Smailor fetches those images from its own servers, so the sender never reaches your browser, and you can hold them until you choose to load them. Those are not cookies, but they raise comparable questions. The Privacy Policy and the Terms of Service explain how open tracking and inbound remote content work, who is responsible, and how to turn each one off.
7. Mobile applications
Our mobile apps do not use browser cookies. They store session and preference data locally on the device and, where you enable notifications, a push token. See the Privacy Policy.
8. Contact and updates
For company details, see our Legal notice. For privacy questions, contact [email protected]; for general support, contact [email protected].
We will update this policy and its "Last updated" date when we change vendors, purposes, or legal requirements relating to cookies.