Serialoom Cookie Policy
| Field | Value |
|---|---|
| Version | 2026-08-05-draft.1 |
| Effective date | [EFFECTIVE DATE] |
| Last updated | 2026-08-05 |
| Status | Counsel-ready draft from inspected implementation |
1. Scope
This Policy explains cookies and similar storage used on https://[DOMAIN] and the Serialoom app.
2. Inventory (verified in code as of 2026-08-05)
| Name | Provider | Purpose | Category | Duration | Party | Consent required? |
|---|---|---|---|---|---|---|
serialoom_session | Serialoom | Signed login session | Strictly necessary | Session / as configured in auth cookie flags | First | No |
serialoom_csrf | Serialoom | CSRF protection for form posts | Strictly necessary | Short-lived / session-style | First | No |
serialoom_workspace | Serialoom | Remembers active workspace id | Strictly necessary / functional | As set by server | First | No (functional preference tightly coupled to service) |
Not found in studio app dependencies: Google Analytics, PostHog, Sentry browser SDK, advertising pixels.
During Paddle checkout
Paddle.js / Paddle-hosted checkout may set additional cookies for payment, fraud, and localization. Those are governed by Paddle’s notices. Treat them as third-party, payment-necessary when you initiate checkout.
Local / session storage
The app may use browser storage for ephemeral UI state. Avoid storing secrets in localStorage.
3. Consent model
- Strictly necessary cookies load to provide the service you request.
- If Serialoom later adds analytics/advertising cookies, they will be off by default in EEA/UK/CH until consent, with a reject option and preference center.
- Global Privacy Control: when non-essential tooling exists, Serialoom should honor GPC as an opt-out signal where required (future implementation).
4. How to control cookies
Browser settings can block cookies; blocking necessary cookies will break login. For Paddle cookies, see Paddle’s documentation.
5. Changes
We will update this inventory when scripts change. Material tracking changes will be reflected here and in the Privacy Policy.
*Counsel-ready draft — 2026-08-05.*