Cookie policy
Last updated 2026-11-02
Spellwarden uses one optional analytics tool, Google Analytics 4, on spellwarden.ai only, and only if you allow it through the consent bar shown on your first visit. We use no advertising cookies and no cross-site tracking for advertising. Everything else spellwarden.ai and the app at dash.spellwarden.ai store in your browser is strictly necessary, and this page lists it item by item.
1. What we use, and when we ask
Strictly necessary storage is what the site needs to sign you in or to provide a feature you asked for, such as accepting an invitation or connecting an app. It needs no consent under the ePrivacy rules, so we do not ask for it. Analytics is different: it needs your opt-in. You give or refuse it in the consent bar shown on your first visit to spellwarden.ai, and you can change your choice at any time with Cookie settings in its footer. Until you allow it, nothing is loaded from Google and no analytics cookie is set.
2. What we actually store, item by item
| Item | Where | Purpose | Cleared |
|---|---|---|---|
| Consent choice | Browser localStorage (key spellwarden.consent.v1), not a cookie | Remembers whether you allowed analytics, so we do not ask on every page. Strictly necessary | 12 months, then we ask again, or when you clear site data for spellwarden.ai |
_ga | First-party cookie set by Google Analytics on spellwarden.ai, only after you allow analytics | Distinguishes visitors, so that the pages read can be counted | 2 years |
_ga_<id> | First-party cookie set by Google Analytics on spellwarden.ai, only after you allow analytics | Keeps the state of a visit | 2 years |
| Item | Where | Purpose | Cleared |
|---|---|---|---|
| Sign-in tokens (ID token, access token, refresh token) | Browser sessionStorage (key spellwarden.auth.session.v1), not a cookie | Keeps you signed in while you use the app. The refresh token renews the session without asking you to sign in again | When you close the browser tab, or when you sign out |
| PKCE verifier and state | Browser sessionStorage (key spellwarden.auth.pending.v1), not a cookie | Proves that a sign-in redirect came back to the browser that started it (PKCE, part of the OAuth sign-in flow) | Once sign-in completes, after 10 minutes, or when you close the tab |
| Single sign-on state | Browser sessionStorage (keys spellwarden.sso.link.v1, spellwarden.sso.linkintent.v1, spellwarden.sso.org.v1 and spellwarden.auth.provider.v1), not a cookie | Only when you use your organisation's single sign-on. Remembers which organisation's sign-in you started and, while you link it to your account, your email address | When you sign out or close the tab; the link request also after 10 minutes |
| OAuth consent request | Browser sessionStorage (key spellwarden.oauth.pending.v1), not a cookie | Only when you connect an AI app. Remembers which app's request you are answering while you sign in | When you allow or decline, after 10 minutes, or when you close the tab |
| Pending invitation | Browser sessionStorage (key spellwarden.invite.v1), not a cookie | Only when you open an invitation link. Keeps it while you sign in or sign up, so you can accept it afterwards | When you accept it, after 1 hour, or when you close the tab |
| Last organisation | Browser localStorage (key spellwarden.lastOrg.v1), not a cookie | Opens the organisation you used last | When you clear site data for dash.spellwarden.ai |
| Theme | Browser localStorage (key spellwarden.theme), not a cookie | Only if you choose light or dark instead of your system's setting | When you choose the system setting again, or clear site data |
| Sign-in session cookies | Cookies set by AWS on our sign-in domain auth.spellwarden.ai (Amazon Cognito), only when your sign-in passes through it, for example with Google or single sign-on | Strictly necessary: completes the sign-in redirect | Per Amazon Cognito's own session lifetime |
Signing in with email and password in the app sends your details directly to Amazon Cognito over an encrypted connection and sets no cookie. Apart from the Google Analytics cookies you choose to allow, none of the above is used for analytics, profiling or advertising, and none of it is shared with a third party for those purposes. The Google Analytics cookies are used for analytics only, never for advertising or profiling.
3. Google Analytics
If you allow analytics, we use Google Analytics 4 to understand which pages of spellwarden.ai are read, so we can improve them. It collects the pages you view, the page that referred you, your approximate location (derived from your IP address, which Google Analytics 4 does not log or store), your device and browser type, and a pseudonymous identifier kept in the _ga cookies.
Google Ireland Limited provides Google Analytics and acts as our processor. Google LLC in the USA may process the data too; see the privacy policy for the safeguards. Google Signals and ad personalisation are turned off, and we do not use this data for advertising.
Google Analytics loads only on the public pages of spellwarden.ai, never in the app or on the sign-in pages. Its event data is kept for 14 months and then deleted automatically. Before you allow analytics, your browser does not contact Google for it. Once you do, your browser contacts www.googletagmanager.com and Google Analytics servers (*.google-analytics.com and *.analytics.google.com), which then see your IP address and browser details, as any server does for a file it serves.
4. Files from third parties
spellwarden.ai and the app serve their fonts, scripts and styles themselves. The only files loaded from a third party come from Google, and only if you allow analytics (see Google Analytics). Signing in with Google or with your organisation's single sign-on takes you to that provider's own pages, under its own cookie rules.
5. Error monitoring (planned)
We plan to add Sentry error monitoring to the app (see the privacy policy). It is not active yet. Before it goes live, we will list here anything it stores in your browser.
6. How you can manage cookies
Choose Cookie settings in the footer of spellwarden.ai to allow or withdraw analytics at any time. Withdrawing deletes the _ga cookies on spellwarden.ai and stops Google Analytics from loading. If you would also like to review or clear what your browser holds, every modern browser lets you inspect and delete site data from its settings (often under Privacy or Site settings). Clearing site data for spellwarden.ai also resets your choice; clearing it for dash.spellwarden.ai signs you out.
7. Changes to this policy
If we ever add another optional feature that needs a non-essential cookie, we will update this page before doing so, not after.
8. Contact
Questions about this policy: hello.invalid [at] spellwarden [dot] ai.