Cookie Policy
Last updated August 8, 2026
This Cookie Policy explains the cookies and similar technologies Tabrio (CD CREATIVE SOLUTIONS S.R.L.) uses, why we use them, and how you can change your choices. It supplements our Privacy Policy.
Our approach: default-deny
Only strictly necessary cookies are set automatically, because Tabrio cannot function without them. Everything else, currently just analytics, stays off until you opt in. When you first visit, a banner lets you Accept all, Reject all, or manage each category. We treat Accept and Reject with equal weight and never pre-tick optional categories.
Strictly necessary
Always active. These keep you signed in and remember your workspace; they cannot be switched off.
| Cookie | Purpose | Provider | Duration |
|---|---|---|---|
| Supabase auth session | Keeps you signed in securely after login. | Supabase (first-party) | Session / up to 1 year |
| active_workspace | Remembers which workspace you last had open. | Tabrio (first-party) | 1 year |
Analytics
Off by default; loaded only after you consent. We use Vercel Web Analytics and Speed Insights, which are cookieless and receive only generic, non-identifying event data (URLs and routes are scrubbed). We also use PostHog, which sets its own cookie and local storage, captures page views (including the visited URL), and identifies signed-in users by their account ID and email. Separately, a small number of server-side product events (for example, finalizing an invoice) are sent to PostHog when you consent; these set no cookie of their own. Billing-provider webhook events, which have no browser request to read a cookie from, are sent with a de-identified id regardless of your analytics choice. The same Analytics consent also covers masked session replay (see “PostHog session replay” below) — materially broader processing than the page-view and event data above, since it records what a screen looked like rather than just that you visited it. We still gate it behind the same single, never-pre-ticked Analytics opt-in described above, rather than treating it as automatically included.
| Cookie | Purpose | Provider | Duration |
|---|---|---|---|
| Vercel Web Analytics & Speed Insights | Aggregate, cookieless measurement of page performance and usage to help us improve Tabrio. Loaded only after you consent. | Vercel (third-party) | No cookie set |
| PostHog product analytics | Page-view and product-usage events (including the page URL) to help us understand and improve Tabrio; identifies signed-in users by account ID and email. Loaded only after you consent. | PostHog (third-party, EU hosted) | Cookie + local storage, up to 1 year |
| PostHog session replay | A visual, masked recording of how you use the app — what you clicked and navigated to — so we can spot confusing screens and bugs. Passwords, emails, and other sensitive fields are always masked; whole screens carrying financial or contract details (invoices, contract reports, workspace/billing settings) are excluded entirely, never recorded. Loaded only after you consent, using the same PostHog script as product analytics above. | PostHog (third-party, EU hosted) | Recordings retained up to 30 days |
Payment
Set by Paddle, our merchant-of-record payment provider, only when you begin a checkout. These are necessary to take payment securely and are governed by Paddle’s own policies.
| Cookie | Purpose | Provider | Duration |
|---|---|---|---|
| Paddle checkout | Set by our payment provider only during a checkout you start, to process the payment and prevent fraud. | Paddle (third-party) | Set during checkout |
Changing or withdrawing consent
You can change your choices at any time, withdrawing consent is as easy as giving it. Open your from here or the footer of any page, or use the “Cookie settings” link. You can also clear cookies through your browser.
Contact
Questions about cookies can be sent to help@tabrio.app or through our Help center.