Cookie Policy

This policy is published by Camada Labs, LLC ("camada"). The privacy policy explains how we use the data involved.

This website

www.camada.app sets no cookies and uses no local storage. Analytics, when enabled, is Cloudflare Web Analytics, which works without cookies or fingerprinting. There is no consent banner because there is nothing to consent to.

The app

my.camada.app sets these cookies, all strictly necessary:

• camada.session_token (__Secure-camada.session_token over https): a signed session cookie set when you sign in, so the app knows who you are. It lasts up to 30 days and is cleared when you sign out.
• camada.state (__Secure-camada.state over https): a signed value that protects the Google sign-in flow, set for 5 minutes and only while you sign in with Google.
• camada_impersonation: set only for camada staff during a logged support session in a customer's organization, and ended with it.
• The support portal at my.camada.app/support sets a signed cookie to keep you signed in to your support requests, and for camada staff a cookie that remembers a trusted device.

The app also keeps display preferences, such as the last project and conversation you opened, in your browser's local and session storage. Sign-in runs inside camada, so no third party sets cookies on the sign-in page.

Applications protected by the SDK

The SDK sets up to two first-party cookies on the customer's own domain. Neither is used for advertising or to follow visitors across sites. A random id tied to one browser still counts as personal data under the GDPR, so the privacy policy covers them.

• _sfp: a random session id, kept for 30 days. It joins the requests of one browser so camada can tell a client with normal page views from one that drops cookies on every request.
• _cch: set only when a visitor passes a challenge. It holds an expiry time and a signature bound to the visitor's IP address, lasts one hour, and lets the visitor through without another challenge.

The optional browser beacon sets no cookies and writes no storage, but it reads device characteristics such as screen size, timezone and graphics renderer; the privacy policy lists them. Customers should mention the cookies and the beacon in their own cookie notice as strictly necessary for security.