Cookie Policy
The cookies and browser storage SeedBasis uses, what each one is for, and how to change your choice.
Last updated 22 October 2026 · Markdown version
Effective 28 September 2026. This policy covers the SeedBasis website and app. The Privacy Policy explains how we handle personal data more broadly.
The short version
- Almost everything we store in your browser is there to make the site work: keeping you signed in, protecting sign-in, and remembering choices you make.
- Google Analytics is the only optional cookie. It loads only after you choose Allow analytics, only on our public marketing pages (the home page, How it works, Method and Pricing), and never inside the app or on sign-in pages.
- If your browser sends a Global Privacy Control signal, we treat it as a refusal: no banner and no analytics.
- You can change your choice at any time with Cookie settings at the bottom of our public pages.
1. What cookies and browser storage are
A cookie is a small piece of text a website stores in your browser and reads back later. Websites can also keep data in your browser's local storage and session storage. The rules on cookies, such as the EU ePrivacy rules, the UK's Privacy and Electronic Communications Regulations and Quebec's privacy law, apply to all of them, and so does this policy. We ask for your consent to optional cookies everywhere, even where the law would let us assume it.
2. The categories we use
| Category | What it does | Needs your consent? |
|---|---|---|
| Strictly necessary | Signs you in, keeps your account secure, protects forms from bots, runs checkout, and remembers choices you make on the site | No. The site cannot work without them, and they are not used to track you. |
| Analytics | Counts visits to our public marketing pages with Google Analytics, so we can see which pages help | Yes. Off until you allow it. |
We do not use advertising, social media or cross-site tracking cookies.
3. Every cookie and storage item
| Name | Set by | What it is for | Category | How long |
|---|---|---|---|---|
better-auth.session_token | SeedBasis | Keeps you signed in. It holds a random session token, never your password | Strictly necessary | 7 days, renewed while you use the service. A session ends 30 days after sign-in at the latest. |
better-auth.state | SeedBasis | Protects sign-in with Google or Apple against forged requests | Strictly necessary | 5 minutes |
better-auth.two_factor | SeedBasis | Remembers that your password was correct while you enter your two-factor code | Strictly necessary | 10 minutes |
better-auth.trust_device | SeedBasis | Skips the two-factor code on this device. Set only if you tick “Trust this device for 30 days” | Strictly necessary, set at your request | 30 days |
sb_consent | SeedBasis | Stores your analytics choice, the version of the banner wording you answered, and a random identifier used to record the choice. Scripts in the page cannot read it | Strictly necessary | About 13 months |
sb_invite | SeedBasis | Keeps the invite link you opened while you make your account. Scripts in the page cannot read it | Strictly necessary, set when you open an invite link | 1 hour |
sb_ref | SeedBasis | Keeps the referral link a friend sent you, so you and your friend each get 100 agent credits when you buy your first report. Scripts in the page cannot read it | Strictly necessary, set when you open a friend's link | 400 days, the longest a browser keeps one, from the last time you opened the link |
sb_src | SeedBasis | Remembers the tag of the link that brought you here, such as a Product Hunt or ad link, which your account keeps if you make one. Set only if you allow analytics cookies, and removed if you withdraw that choice | Analytics | 30 days |
theme (local storage) | SeedBasis | Remembers whether you chose light or dark mode | Strictly necessary, set at your request | Until you clear it |
seedbasis:offer-code (local storage) | SeedBasis | Keeps the 10% code from the link in your offer email, so checkout can put it on for you | Strictly necessary, set at your request | Until a purchase uses it, or you clear it |
seedbasis:offer-prompt (local storage) | SeedBasis | Remembers that you closed the 10% offer on the Pricing page or asked for your code, so it does not open by itself again | Strictly necessary, set at your request | Until you clear it |
seedbasis:onboarding-draft (session storage) | SeedBasis | Keeps your onboarding answers while you fill them in, so a refresh does not lose them | Strictly necessary | Until you close the tab or start the report |
_ga | Google Analytics | Tells visitors apart | Analytics | 2 years |
_ga_<container-id> | Google Analytics | Keeps track of the current visit | Analytics | 2 years |
| Cloudflare Turnstile | Cloudflare, from challenges.cloudflare.com | Checks that a person, not a bot, is signing up, resetting a password, or signing in after repeated failures | Strictly necessary | No cookie: the check sets one only with pre-clearance, which is off |
| Stripe checkout | Stripe and Link, on their own payment page at checkout.stripe.com, which Buy takes you to; none on our pages | Runs the payment page and protects payments against fraud | Strictly necessary | Set out in Stripe's cookie policy and Link's privacy policy |
- In production, the sign-in cookies carry the
__Secure-prefix, for example__Secure-better-auth.session_token, so browsers only send them over HTTPS. - The Google Analytics lifetimes are the defaults Google documents for these cookies.
- When you sign in with Google or Apple, or pay on Stripe's payment page, you are on their sites, so their own cookies and policies apply there.
4. Your choice
- The banner appears on our public marketing pages until you choose. No thanks and Allow analytics are equally easy, and nothing optional loads before you choose.
- To change your mind, use Cookie settings at the bottom of our public pages. If you withdraw consent, we delete the Google Analytics cookies from your browser and reload the page without analytics.
- If your browser sends a Global Privacy Control signal, we treat it as a refusal and neither show the banner nor load analytics.
- If we change the wording of the banner, we ask you again.
- You can also block or delete cookies in your browser's settings. Blocking the strictly necessary ones stops sign-in from working.
5. If you do not allow analytics
Nothing changes for you. Every page and every feature works the same. Google Analytics does not load, sets no cookies, and receives nothing about your visit.
6. What Google Analytics receives if you allow it
- The address of the page you view without any query string, the page title, and technical details such as your browser, device and approximate location, which Google works out from your IP address.
- Google signals and advertising personalisation are switched off, and advertising storage is denied.
- No idea text, report content, email address or account identifier is sent.
- Google processes this data for us under the Google Ads Data Processing Terms, which cover Google Analytics. Analytics data is kept for 2 months.
7. Changes and contact
We update this policy whenever we add, remove or change a cookie. Questions about cookies: privacy@seedbasis.com.