# Cookie Notice

## 1. Necessary identity and security storage

Podda sets cookies or similar browser storage needed to create and maintain a secure sign-in session, protect the authentication flow and remember necessary identity state. These items cannot be switched off.

Podda also uses short-lived session storage to preserve a safe return path during sign-in and to hold a pending single-use invitation while the account flow completes. This information stays in the browser tab/session and is removed after it serves its purpose.

Generated apps use a short-lived, secure, HTTP-only session cookie after Podda verifies current membership. It is necessary to prevent a copied app address from granting access.

### Current necessary-storage inventory

| Item                                                             | Set by | Purpose                                                                          | Normal duration                                                                     |
| ---------------------------------------------------------------- | ------ | -------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------- |
| Podda session and security cookies or equivalent browser storage | Podda  | Sign-up, sign-in, session security, fraud prevention and account continuity      | Session-based or the duration assigned to the authenticated session                 |
| `podda_return_to` session storage                                | Podda  | Return you to the intended first-party page after sign-in                        | Removed when the flow completes or when the browser-tab session ends                |
| `podda_invitation_pending` session storage                       | Podda  | Hold one pending invitation while sign-in or sign-up completes                   | Removed after acceptance, rejection or expiry, or when the browser-tab session ends |
| `__Host-podda_app` cookie on a generated-app host                | Podda  | Carry a signed, app-specific membership session after an entry code is exchanged | Five minutes                                                                        |

These items do not record activity for advertising. You can inspect and remove browser storage through browser controls, but removing necessary storage may sign you out or interrupt an invitation or app session.

## 2. Categories

### Strictly Necessary

Always active. Covers authentication, security, session routing, invitation continuity, recording a privacy choice and, for signed-in users, linking a submitted privacy choice to the account so that Podda can honour it in authenticated services. These functions cannot be disabled through Cookie Settings because they are necessary to provide the functionality of the service. Linking a privacy choice does not itself enable Analytics or Marketing.

### Analytics

Podda uses Analytics to understand use of the service and measure its performance. Podda may also process service telemetry and diagnostics generated through authenticated and agent-facing services to operate, diagnose and improve Podda. Account identity is used for Analytics only where the latest applicable privacy choice permits it. In locations where prior consent is required, browser Analytics remains inactive until you allow it. Elsewhere, browser Analytics may be active by default unless you turn it off through Cookie Settings.

### Marketing

Podda uses Marketing storage and pixels to measure campaigns, record signup or purchase conversions and create advertising audiences. In locations where prior consent is required, Marketing remains inactive until you allow it. Elsewhere, Marketing may be active by default unless you turn it off through Cookie Settings. Marketing providers and advertising recipients are identified in our [Privacy Notice](/privacy).

## 3. Changing your choice

Use the Cookie Settings control above or in the site footer to allow or deny Analytics and Marketing at any time. Your choice is first stored for the current browser. If you are signed in after submitting a choice, Podda links that browser’s privacy-choice record to your account so that the latest linked choice can be honoured in authenticated services. If linked choices differ, the most recently recorded explicit choice controls account-linked analytics.

You can also remove browser storage through your browser. Doing so may sign you out, clear pending invitations or cause Podda to ask for a privacy choice again.

Questions can be sent to [legal@podda.app](mailto:legal@podda.app).