Legal
Cookie policy
Three cookies, all strictly necessary to sign you in and keep you signed in. No advertising, no tracking, no banner.
Last updated June 1, 2026
1. The short version
Docsmith sets three cookies. All three are strictly necessary for the site to work. None of them tracks you across other websites, none is used for advertising, and none is shared with a third party.
2. What we set
| Name | Purpose | Expires | Type |
|---|---|---|---|
docsmith.session-token | Keeps you signed in. Encrypted, HTTP-only, and namespaced to Docsmith so it cannot collide with another application on the same host. | 30 days | Strictly necessary |
authjs.callback-url | Remembers where to send you back to after signing in with GitHub or Google. | Session | Strictly necessary |
authjs.csrf-token | Protects sign-in and sign-out from cross-site request forgery. | Session | Strictly necessary |
If you have never signed in, only the CSRF token is set, and only when you visit a sign-in page.
3. Why there is no consent banner
Under the ePrivacy Directive and the UK PECR, consent is not required for cookies that are strictly necessary to provide a service the user has asked for. Signing in is such a service. Since we set nothing else, there is nothing to consent to, and a banner would be theatre.
If that ever changes, the banner will appear and it will have a reject all button that is exactly as easy to press as accept.
4. Analytics
We do not run Google Analytics, or any third-party analytics that sets a cookie or fingerprints your browser. We count page requests in our own server logs, which record the URL, a truncated IP address, the referrer and the user agent, and are deleted after 30 days. Those logs are not cookies and cannot be used to follow you anywhere else.
5. Controlling cookies
Every browser lets you block or delete cookies, usually under privacy settings. Blocking ours will not break the marketing site — you can read every page and run the demo without signing in — but you will not be able to stay signed in to the dashboard, because staying signed in is what the cookie does.
6. Changes
If we add a cookie, this table changes before it ships and the date at the top of the page is updated. See also the privacy policy for how we handle personal data more broadly. Questions: privacy@docsmithhq.com.