What cookies are
Cookies are small files a website stores in your browser. Similar technologies, such as local storage, work the same way. Under EU rules, a website needs your consent before it stores anything on your device, unless that storage is strictly necessary for a service you asked for.
What this website stores
The first time you visit, a banner asks whether we may use analytics cookies, which come from Google Analytics. Nothing that needs your consent is stored until you accept. This is everything the site can store:
| Name | Type | Purpose | Duration |
|---|---|---|---|
cofix_consent | Cookie, strictly necessary | Remembers whether you accepted or declined analytics cookies, so we don't ask on every page. | 6 months |
theme | Local storage, strictly necessary, only after you use the theme switch | Remembers whether you chose light or dark mode. It stays in your browser and is never sent to us. | Until you clear your browser's site data |
_ga | Cookie, analytics, only if you accept | Set by Google Analytics: a random ID that tells one visitor's visits apart from another's. | 13 months |
_ga_4XX22SPM25 | Cookie, analytics, only if you accept | Set by Google Analytics: keeps track of the current visit. | 13 months |
The first two only do what you asked for, so they don't need consent. The cookies are set for co-fix.com and its subdomains, so the CoFix app at app.co-fix.com uses the same choice, and a visit that goes on in the app counts as one visit confirm once the app reads cofix_consent.
What the CoFix app stores
The CoFix app at app.co-fix.com is where you sign in and work. It sets one cookie, to keep you signed in, and keeps a few settings in your browser's local and session storage. None of it is used for analytics or advertising, and none of it is shared with other services.
| Name | Type | Purpose | Duration |
|---|---|---|---|
refresh_token | Cookie, strictly necessary | Keeps you signed in. It is replaced each time your session renews, and scripts on the page can't read it. | 21 days confirm with the auth service, with its domain and flags |
org_slug, tenant_domain | Local storage, strictly necessary | Remember which organisation you're signed in to, so a reload opens the right workspace. | Until you sign out |
selected_project_id | Local storage, strictly necessary | Opens the project you last worked in. | Until you sign out |
theme_mode | Local storage, strictly necessary, only after you use the theme switch | Remembers whether you chose light, dark or system mode. | Until you clear your browser's site data |
cofix-recent-accounts | Local storage, functional | On the sign-in page, offers up to three accounts that signed in on this browser: the email address, name, user ID and profile picture link. Never a password. | Until you clear your browser's site data. It stays after you sign out. confirm whether this needs consent or an opt-out |
cofix-has-signed-in | Local storage, functional | Lets the sign-in page welcome you back instead of greeting you as new. | Until you clear your browser's site data |
cofix:product-tour-seen:…, cofix:product-tour-steps-seen:…, cofix:page-tour-seen:…, cofix:onboarding-offered:…, cofix.codeReviewFirstRun.dismissed.…, cofix-ticket-setup-hidden, cofix-ticket-setup-finished | Local storage, strictly necessary | Remember which product tours, tips and set-up notices you've already seen or closed, so they don't come back. | Until you clear your browser's site data |
issues_resolved_locally, diagnosis_notified_job_ids | Local storage, strictly necessary | Remember which issues you marked as resolved and which AI diagnoses you've already been told about. | Until you clear your browser's site data |
post-login-redirect | Session storage, strictly necessary | Takes you back to the page you asked for once you've signed in. | Until you close the tab |
github_connect_project, github_connect_return | Session storage, strictly necessary | Bring you back to the right project after you install the GitHub app. | Until you close the tab |
trial-banner:… | Session storage, strictly necessary | Keeps the trial reminder closed after you close it. | Until you close the tab |
The app loads its typefaces from Google Fonts, so Google receives your IP address when you open it. Google Fonts sets no cookies. The app also loads CoFix's own error-reporting script, served from Microsoft Azure, which sends us details of errors in the app confirm what it sends and that it stores nothing in the browser.
Third-party services
Until you accept analytics cookies, pages load nothing from other services: the site's typefaces and scripts are served from this website itself, so no third party can set cookies or receive your IP address through it.
If you accept, each page loads Google Analytics from Google, which receives your IP address and the details the Privacy Policy lists, and sets the _ga cookies above. Google signals and ad personalisation are switched off.
The demo form and the newsletter form send what you type straight to HubSpot, which stores it for us. We send them without HubSpot's tracking code, and your browser neither sends nor accepts cookies with them, so HubSpot's usual cookies (such as hubspotutk and __hstc) are never set on your device. HubSpot does receive your IP address, as the Privacy Policy explains.
We don't use advertising or social media tracking. If we ever add them, we'll ask for your consent first and update this page.
Product update emails
If you subscribe, HubSpot sends the product update emails for us. It records whether you open each email, using a tiny image inside it, and which links you click, because links go through HubSpot on their way to the page confirm HubSpot's email tracking settings.
Links in the email may carry HubSpot codes in the address, such as _hsenc. This website runs no HubSpot code, so nothing on the page reads them and no cookies are set when you arrive.
How to control storage
To change your choice, use Cookie settings at the foot of any page. Declining switches Google Analytics off straight away and deletes its cookies.
You can remove everything this site stores at any time by clearing this site's data in your browser settings. Signing out of the app removes your organisation and project from your browser, and clearing app.co-fix.com's site data removes the rest, though you'll then need to sign in again. Your browser's help pages explain how to block or delete cookies and site data.
To stop product update emails, use the unsubscribe link at the bottom of any of them. Most email apps can also block images, which stops open tracking.
Contact
Questions about this policy: hello@co-fix.com.