1. What are cookies?
Cookies are small text files placed on your device by websites you visit. We also use related technologies such as web beacons, pixel tags, and local storage. This policy refers to all of these collectively as "cookies." Cookies allow us to recognise your browser, remember your preferences, and improve your experience.
2. Categories of cookies we use
We use four categories of cookies, each requiring different consent under GDPR and ePrivacy rules:
- Strictly necessary cookies (always on). Required to deliver the Services — authentication, session management, security tokens, CSRF protection, load balancing. These cannot be disabled while you are logged in.
- Functional cookies (consent-based, default off in EU/UK). Remember your preferences (language, time zone, theme, sidebar state) so the Services feel personalised.
- Analytics cookies (consent-based). Help us understand aggregate usage — which features are used, where errors occur, where users get stuck. We use privacy-respecting analytics; data is aggregated and we do not sell or share with ad networks.
- Marketing cookies (consent-based). Used on our marketing website only (
boxes.sh) to measure campaign effectiveness and to show relevant ads on partner platforms. Never used inside the product (my.boxes.sh).
3. Specific cookies we set
| Cookie | Category | Purpose | Duration |
|---|---|---|---|
boxes_session | Strictly necessary | Maintain your signed-in session | 14 days (sliding) |
boxes_csrf | Strictly necessary | CSRF protection token | Session |
boxes_workspace | Strictly necessary | Remember which workspace you last opened | 30 days |
boxes_lang | Functional | Remember your language preference | 365 days |
boxes_theme | Functional | Remember your light/dark theme | 365 days |
_plausible_* | Analytics | Privacy-respecting usage analytics (cookie-less by default) | Session |
_li_* (marketing site only) | Marketing | LinkedIn ad-conversion tracking | 30 days |
_gcl_au (marketing site only) | Marketing | Google Ads conversion tracking | 90 days |
4. How to control cookies
You can control cookies in three ways:
- Our cookie banner. On your first visit from the EU, UK, or other consent-required regions, we present a banner where you can accept all, reject non-essential, or customise by category. You can change your choices any time via the “Cookie settings” link in the footer.
- Your browser. Most browsers allow you to block or delete cookies. See the help pages for Chrome, Safari, Firefox, and Edge. Note: disabling strictly-necessary cookies will prevent you from signing in.
- Industry opt-outs. For marketing cookies on our marketing website, you can opt out via YourAdChoices (US), YourOnlineChoices (EU), or your Network Advertising Initiative opt-out page.
5. Do Not Track
We honour the Global Privacy Control (GPC) signal. When your browser sends GPC, we treat it as an opt-out of marketing and analytics cookies. We do not respond to legacy DNT headers because there is no consistent industry standard for interpreting them.
6. Updates to this policy
We may update this Cookie Policy from time to time. Material changes will be communicated through our cookie banner. The “Last updated” date at the top of this page reflects the most recent revision.
Questions? Email privacy@boxes.sh.