Cookie Policy
How BoardCraft uses cookies.
BoardCraft uses essential cookies and similar technologies to keep the app secure and working, and gives you a choice about optional functional storage, analytics, and marketing technologies.
Cookie policy details
Effective date: June 20, 2026
Last updated: October 4, 2026
1. About This Policy
This Cookie Policy explains how BoardCraft uses cookies, local storage, session storage, IndexedDB, scripts, software development kits, pixels, device identifiers, and similar technologies when you visit or use the BoardCraft website, editor, dashboard, templates, account features, billing pages, and related services.
This policy should be read together with our Privacy Policy and Terms of Service.
2. What Cookies Are
Cookies are small text files placed on your computer, phone, tablet, or other device when you visit or use a website. They can help a website remember information about your visit, such as login status, security state, preferences, device settings, or previous actions.
Similar technologies can store or access information on your device in other ways. In this policy, we use "cookies" as shorthand for cookies and similar technologies unless the context requires a narrower meaning.
First-party storage belongs to the BoardCraft site you visit; third-party storage belongs to another provider domain. Persistent storage can survive browser closure, while session storage normally lasts for the current tab session. Browser storage lifetimes differ from the retention of information already sent to our servers or providers.
3. Why BoardCraft Uses Cookies
- Keep the Service secure and prevent fraud, bot activity, unauthorized access, and misuse.
- Allow you to create, sign in to, and remain signed in to your account.
- Verify email status, route users correctly, and protect restricted areas of the Service.
- Remember cookie choices and privacy preferences.
- Save certain editor, interface, font, color, and account preferences.
- Support billing, subscription, checkout, and account-management workflows.
- Understand how users interact with BoardCraft when analytics consent is enabled.
- Diagnose technical issues, crashes, and performance problems.
- Measure product communications and marketing activity where permitted and enabled.
4. Categories We Use
Strictly necessary cookies
These are required for BoardCraft to function securely and correctly. They support authentication, session management, protected app routing, email-verification checks, admin/editor access controls, account restrictions, billing flows, security, and consent preference storage. Because these technologies are necessary to provide the Service you request, they may be used without consent where applicable law allows.
Functional preference technologies
These help BoardCraft remember choices such as recent colors, recent fonts, editor state, interface preferences, dismissed notices, and similar settings. Some preferences are saved in localStorage or sessionStorage rather than traditional cookies. We persist these optional preferences only when you enable functional storage. Without it, preferences remain available in memory for the current page. Withdrawing functional consent removes the stored preferences; it does not change your saved boards or account-profile settings.
Optional product analytics
Analytics and performance technologies help us understand product usage, page views, feature adoption, export activity, and technical performance. BoardCraft uses Firebase Analytics only after analytics consent is enabled. If you are signed in, usage can be associated with your account identifier and include page paths, board identifiers, and feature activity. Withdrawing analytics consent disables future Firebase Analytics collection in that browser.
With analytics consent, BoardCraft also measures signed-in clicks from product update emails and use of the announced feature within seven days of the first click. This account-linked measurement uses our application database and stops when you withdraw analytics consent. Email subscription choices are managed separately in Account settings and through the preferences link in BoardCraft emails.
Operational hosting and monitoring
Vercel hosts the Service and provides Speed Insights, which measures page URLs and routes, browser and device information, operating system, network speed, country, timestamps, and web performance metrics. Sentry reports errors and diagnostic logs and monitors server and edge performance. Server and edge diagnostics may contain personal request information, including IP addresses or other identifying context. These tools currently run independently of the optional Firebase Analytics choice. Rejecting analytics does not disable all monitoring, and diagnostic information is not necessarily anonymous. Their use remains subject to applicable law and any consent requirements.
Marketing cookies
Marketing technologies may help measure campaign effectiveness, waitlist/signup activity, product lifecycle communications, and promotional activity. BoardCraft may use Loops for marketing communications and product-related messages. Browser-side marketing cookies, pixels, retargeting scripts, or similar tools stay off unless you enable marketing cookies. BoardCraft does not load ad pixels by default.
Signup email choices are separate from cookie choices. Matched US signups may have email options selected by default with a clear signup opt-out; other and unknown locations use unchecked email options. We keep the country codes and enrollment basis with the signup record, without retaining raw IP addresses for this purpose.
Loops contact synchronization and lifecycle events are sent from our servers when enabled. They can include your email, name, account ID, plan, subscription status, role, board count, account and activity timestamps, and indicators of board creation, exports, uploads, or template publishing. The browser marketing toggle does not control these transfers or your email subscription preferences. To unsubscribe from marketing messages or object to related processing, email support@boardcraft.app. Essential account, security, billing, and requested support messages may continue. Unsubscribing does not automatically delete contact data, and suppression records may remain to respect your preference.
Third-party service technologies
Some BoardCraft features rely on third-party services. Firebase and Google Cloud support authentication, analytics, storage, and infrastructure; Cloudflare Turnstile supports abuse prevention; Freemius supports checkout and subscription management; Sentry supports diagnostics; Vercel supports hosting and performance measurement; Loops supports communications; and Google services may support sign-in, fonts, or related functionality. Third-party providers may process information under their own policies when you interact with their services.
The Freemius checkout script loads when you request checkout. Billing portal technologies load when you use subscription-management features. Provider-controlled payment and security technologies may be needed to complete those actions. Optional provider technologies are subject to the provider's own controls.
5. Cookie and Storage Table
| Category | Purpose | Examples | Consent | Duration |
|---|---|---|---|---|
| Server session (necessary) | Authentication, signed-in sessions, routing, protected app access, email verification checks, account restrictions, security, and core app features. | boardcraft-session (first-party cookie) | Not optional where legally exempt | Up to 7 days; cleared on sign-out |
| Access controls (necessary) | Remember role, email verification restrictions, and account restrictions for app routing. | boardcraft-role, boardcraft-email-gate, boardcraft-banned (first-party cookies) | Required for protected app access | Up to 30 days; cleared or updated when authentication or account state changes |
| Firebase sign-in (necessary) | Keep you signed in and refresh your authentication state. | Firebase IndexedDB (firebaseLocalStorageDb), with localStorage or sessionStorage fallbacks | Required for requested account access | Persistent sign-in state survives browser closure until sign-out, removal, or invalidation; session-storage fallback lasts for the tab session |
| Consent preferences | Remember your functional, analytics, and marketing choices, consent version, and choice timestamp. | boardcraft_cookie_consent_v2 (first-party localStorage) | Required to remember your choice | Choice valid for 180 days; earlier renewal if the consent version changes. An expired record is removed when next checked |
| Security and anti-abuse | Protect contact, waitlist, account, checkout, and app workflows from automated abuse, fraud, and malicious traffic. | Cloudflare Turnstile, BoardCraft security checks | Usually not optional where used for security | Provider-controlled security storage, where used; actual clearance-cookie settings depend on the deployed Cloudflare configuration |
| Functional preferences | Remember editor settings, recent colors, and walkthrough progress between visits. | boardcraft-ui, boardcraft-recent-colors, boardcraft-recent-colors-board, boardcraft-editor-walkthroughs; legacy boardcraft-editor-walkthrough (first-party localStorage) | Only persisted after functional consent; otherwise held in page memory | Until cleared, replaced, or functional consent is withdrawn or expires |
| Recent fonts (optional) | Remember the fonts you recently selected. | boardcraft-recent-fonts (first-party sessionStorage) | Only persisted after functional consent; otherwise held in page memory | Tab session, or until functional consent is withdrawn or expires |
| Editor clipboard (requested feature) | Copy and paste canvas elements across your boards and tabs; includes copied element content, owner and source-board identifiers, and a copy timestamp. | boardcraft:editor-clipboard:v1:<user> (first-party localStorage) | Used when you request copy/paste; separate from optional preferences | Until replaced, cleared, or signed out; no automatic time-based expiry |
| Export recovery (requested feature) | Recover requested pending exports after navigation or reload; includes job, user and board identifiers, format, filename, timestamp, and initiating tab identifier. | boardcraft.pending-export-jobs.v1 (first-party localStorage) | Used for exports you request; separate from optional preferences | Entries removed when the app resolves the job; unresolved entries may remain until browser data is cleared |
| Cross-tab cache coordination (necessary) | Notify other tabs that board lists need refreshing. | boardcraft:board-cache-revision (first-party localStorage) | Required for current board data across tabs | Latest revision until overwritten or browser data is cleared |
| Optional product analytics | Measure page views, feature usage, product events, and usage associated with an account identifier when signed in. | Firebase Analytics; _ga and _ga_<container-id> (first-party cookies) | Yes where required; Firebase Analytics starts only after analytics consent | Google's documented default cookie expiry is 2 years, subject to property settings and browser limits; accessible cookies are removed when analytics is declined |
| Operational monitoring | Host the Service, diagnose errors and request failures, and measure web performance, URLs/routes, network speed, browser/device information, operating system, country, and timestamps. | Vercel hosting and Speed Insights, Sentry | Currently runs independently of the optional Firebase Analytics toggle; applicable legal requirements still apply | Depends on provider settings; fixed deletion periods have not been established |
| Marketing | Allow future browser-side marketing or attribution scripts if enabled. | Future browser marketing scripts; no ad pixels currently loaded | Browser-side marketing technologies stay off unless enabled; this choice does not subscribe you to emails | No browser marketing storage currently used |
| Server-side communications | Synchronize contact profiles and feature-use indicators, manage newsletter/waitlist subscriptions, and support lifecycle communications. | Loops, BoardCraft server-side marketing events | Separate from browser cookie choices; contact support to unsubscribe or object to related processing | Depends on communication needs, suppression records, applicable law, and provider settings |
| Billing and subscription | Load checkout, process subscription workflows, manage customer portals, prevent payment fraud, and confirm billing status. | Freemius checkout and customer portal technologies | Checkout SDK loads when you request checkout; necessary payment/security storage supports that transaction. Provider optional cookies are subject to its controls | Provider-controlled; depends on checkout, portal, and payment-provider settings. See the linked Freemius cookie policy |
This table describes categories of use rather than every provider cookie that may exist at a given time. Provider cookie names, expiration periods, and storage behavior can change as third-party services update their systems.
6. Local Storage and Similar Technologies
BoardCraft uses browser storage in addition to traditional cookies. For example, your cookie preference is stored in localStorage using boardcraft_cookie_consent_v2. The table above identifies our editor settings, recent colors and fonts, walkthrough progress, copied canvas content, pending export metadata, and cross-tab cache revision storage. Firebase also uses IndexedDB or browser-storage fallbacks for persistent authentication.
Local storage and similar technologies can remain on your device until you clear browser data, change your browser settings, or BoardCraft removes or replaces the stored value. Where required by law, we will obtain consent before using non-essential local storage or similar technologies.
Clipboard and export-recovery storage support actions you request and are separate from optional preference persistence. Clearing local storage can remove copied content and pending-export recovery metadata. Cookie settings apply to the current browser and site origin; other devices, browser profiles, or origins can have different choices.
7. How We Obtain Consent
Where required by applicable law, BoardCraft asks for your consent before placing or accessing non-essential cookies or similar technologies. Our cookie consent tool allows you to accept all cookies, reject non-essential cookies, or choose whether to allow functional storage, optional Firebase Analytics, and browser marketing technologies. These controls do not manage server-side email contact synchronization or the operational monitoring described above.
Your consent is voluntary. Public parts of BoardCraft remain available without accepting non-essential cookies, although some specific features may need essential cookies or third-party technologies to function. BoardCraft does not treat silence, continued browsing, inactivity, or closing the cookie banner as consent where applicable law requires affirmative consent.
We remember a choice for 180 days and ask again after expiry or when the consent version changes. The new functional-storage choice uses a new consent version, so older choices must be renewed. If browser storage is blocked, your choice can apply for the current page but may not be remembered on your next visit.
8. Managing Your Preferences
You can change your functional, analytics, and marketing choices at any time from the "Cookie settings" link in the site footer. Withdrawing consent does not affect the lawfulness of processing that occurred before withdrawal.
Disabling analytics stops future Firebase Analytics collection in that browser and removes accessible BoardCraft Google Analytics cookies. Changes are shared with other open BoardCraft tabs on the same origin through browser storage events. Browser restrictions can limit cleanup or synchronization; browser controls can clear remaining stored data. Data already sent to providers is not erased by this browser control. Contact support to request erasure or other action on previously collected data; those requests require separate processing. Your browser marketing choice is separate from newsletter and waitlist subscriptions; contact support to change email preferences.
You can also use your browser settings to view cookies, delete cookies, block third-party cookies, block all cookies, or clear local storage and other browsing data. Browser controls vary by browser and device.
Blocking or deleting cookies may affect BoardCraft functionality, including sign-in, account access, editor preferences, checkout, exports, template previews, protected media, and security controls.
9. Do Not Track and Browser Privacy Signals
Some browsers offer "Do Not Track" settings or similar privacy signals. Because there is no universal standard for interpreting all Do Not Track signals, BoardCraft may not respond to every such signal.
BoardCraft does not currently sell personal information for monetary consideration or knowingly share personal information for cross-context behavioral advertising. Where applicable law requires us to recognize legally valid browser-based privacy preference signals, such as Global Privacy Control or similar signals, we will process those signals in accordance with applicable law.
When your browser exposes an active Global Privacy Control signal, BoardCraft keeps optional Firebase Analytics and browser marketing off, including when an earlier choice allowed them. These switches cannot be enabled while that signal is active. Functional storage remains a separate choice. Turning GPC off does not restore earlier analytics or marketing opt-ins; you can choose again in Cookie settings. Do Not Track does not automatically change these preferences. GPC does not unsubscribe you from emails or disable the operational monitoring described in this policy.
10. Changes to This Policy
We may update this Cookie Policy from time to time to reflect changes in our use of cookies, local storage, service providers, legal obligations, or BoardCraft features. When we make material changes, we will update the "Last updated" date and may provide additional notice through the Service, by email, or through our cookie preference tool.
11. Contact Us
If you have questions about this Cookie Policy or our use of cookies, contact BoardCraft at support@boardcraft.app. For more information about how we handle personal information, please review our Privacy Policy.