Cookie Policy
Last updated: 27 April 2026
1. Overview
Cookies and equivalent storage technologies (localStorage, sessionStorage, IndexedDB) are small data items placed on your device. We use them to operate FORTE/CYBERx, remember your preferences, measure usage, capture session-replay recordings of in-product interactions, and (with consent on the public surface) attribute marketing.
2. Categories
- Strictly necessary — required for sign-in, CSRF protection, and the application to function. Cannot be disabled.
- Functional — remember theme, command-palette state, last-viewed mission, dismissed banners, feature-flag cache.
- Analytics — Amplitude product telemetry (events, sessions, autocapture) and Google Analytics 4. Scoped as noted below.
- Marketing — LinkedIn Insight Tag for conversion attribution on the public surface only. Not loaded inside
/app/*.
3. Cookie & local-storage inventory
| Name | Purpose | Duration | Type |
|---|---|---|---|
| sb-access-token | Supabase session token | 1 hour | Strictly necessary |
| sb-refresh-token | Supabase refresh token | 7 days | Strictly necessary |
| sb-mfa-aal | Multi-factor authentication assurance state | Session | Strictly necessary |
| cc-trusted-device | Remember-this-device token (skips MFA prompt) | 30 days | Strictly necessary |
| cc-theme | UI theme preference (light/dark) | 365 days | Functional |
| cc-cmdk-state | Command palette state | 30 days | Functional |
| cc-banners-dismissed | Suppress dismissed in-product banners | 365 days | Functional |
| AMP_* | Amplitude device ID, session ID and user properties | 365 days | Analytics |
| AMP_MKTG_* | Amplitude marketing attribution (UTM, referrer) | 365 days | Analytics |
| _ga | Google Analytics 4 — visitor distinct ID | 2 years | Analytics |
| _ga_* | Google Analytics 4 — session state | 2 years | Analytics |
| li_*, bcookie, lidc | LinkedIn Insight Tag — conversion attribution (public surface only) | 30 days – 2 years | Marketing |
4. Consent management
We rely on implied consent for strictly necessary and functional cookies. Analytics and marketing cookies on the public surface are loaded only when local browser settings allow them (Do Not Track, Global Privacy Control). A formal in-product consent banner will be added prior to material EU traffic onboarding; in the interim, EU/UK/Swiss visitors can withdraw consent at any time via the Opt-out instructions in §6 below.
5. Session replay
We do not capture session-replay recordings. Analytics is limited to event-level telemetry (page views, clicks, form interactions and custom product events) collected via Amplitude. The contents of input fields, password fields and mission text areas are never transmitted to our analytics provider.
6. Opt-out per browser
- Chrome: Settings → Privacy and security → Cookies and other site data.
- Safari: Settings → Privacy → Manage Website Data.
- Firefox: Settings → Privacy & Security → Cookies and Site Data.
- Edge: Settings → Cookies and site permissions.
You can opt out of LinkedIn marketing cookies at the LinkedIn opt-out page, and Google Analytics via the Google Analytics opt-out add-on.