Cookie Policy
Effective Date: January 1, 2026 • Last Updated: October 27, 2026
Authentication tokens are isolated in HttpOnly, SameSite cookies inaccessible to malicious scripts.
We never deploy third-party advertising cookies, behavioral profiling, or data brokerage trackers.
Strict cross-site request forgery tokens guard every state-changing workspace action.
1. What Are Cookies?
Cookies and local storage technologies are small text files or key-value entries stored in your browser when you interact with Postlyn (“we,” “us,” or “our”). They enable essential security, authentication session persistence, and interface preferences across page navigations.
2. Cookies We Actually Use
Postlyn enforces a lean, privacy-first technical standard. We use only strictly necessary and functional storage mechanisms:
| Cookie / Key | Category | Duration | Purpose |
|---|---|---|---|
| accessToken | Strictly Necessary | 15 Minutes | Encrypted JWT session authentication token stored in HttpOnly, SameSite=Lax cookie. |
| refreshToken | Strictly Necessary | 7 Days | HttpOnly rotation token used to refresh expired access credentials securely. |
| csrf_token | Strictly Necessary | Session | Guards mutating endpoints (POST, PUT, DELETE) against Cross-Site Request Forgery. |
| theme | Functional Preference | Persistent | Remembers your user interface color mode (Light Mode vs. Dark Mode). |
| activeWorkspaceId | Functional Preference | Session | Preserves your active multi-tenant workspace context between browser page reloads. |
3. Third-Party Advertising & Tracking Disclosure
We believe software should serve you, not track you across the web. Postlyn:
- No Ad Retargeting Pixels: We do not load Facebook Pixel, Google Ads remarketing tags, TikTok pixels, or third-party behavioral beacons.
- No Data Brokering: We never sell, lease, or syndicate user browsing telemetry to data brokers or advertising syndicates.
4. Managing & Disabling Cookies
Most web browsers automatically accept cookies by default, but you can configure your browser settings to reject or delete cookies. Please note that because Postlyn uses HttpOnly cookies exclusively for secure authentication and CSRF defense, disabling cookies will prevent you from signing in or utilizing workspace automation tools.
5. Privacy & Security Inquiries
For questions regarding our cookie implementation or technical storage policies, reach our privacy officers:
For inquiries or legal notices, please reach out directly through our Contact & Support Center.