Cookie Policy

1. What Are Cookies & Browser Storage?

Cookies are small text files that a website places on your device (computer, tablet, or mobile phone) when you visit it. They allow the website or application to recognize your browser, keep you authenticated across page loads, and remember your preferences. Alongside HTTP cookies, modern web applications also use browser localStorage and sessionStorage for fast, client-side state management. In this Cookie Policy, we refer to cookies, local storage, and session storage collectively as “cookies.”

• First-party cookies are set directly by Unravler domains (unravler.com and app.unravler.com).
• Third-party cookies are set by trusted service providers (such as authentication, bot-protection, or product analytics services).
• Session cookies are temporary and expire automatically when you close your browser or sign out.
• Persistent cookies remain on your device until they reach their scheduled expiration date or you delete them via your browser settings.

2. The Legal Basis for Using Cookies

Applicable data protection laws (including the EU/UK GDPR, ePrivacy Directive, and India’s DPDP Act) permit us to store cookies and browser storage on your device where they are strictly necessary for the operation and security of our website and authenticated application. For optional preference or product-statistics storage, we rely on your consent or provide clear opt-out controls depending on your jurisdiction.

3. How We Manage Consent & Cross-Domain Scope

When you use Unravler, you can manage non-essential cookie preferences through our in-app consent controls or your browser settings. We also honor browser-level privacy signals where supported. Your choices apply across our related Unravler Outreach domains:

• www.unravler.com / unravler.com (Public marketing site, documentation, and legal pages)
• app.unravler.com (Authenticated Unravler Outreach web application)
• api.unravler.com (Backend API and session authentication service)

4. Categories of Cookies & Storage We Use

We classify cookies and browser storage across our properties into the following categories:

• 4.1 Strictly Necessary Cookies: Essential for signing in to app.unravler.com, maintaining your authenticated workspace session, enforcing security headers, and protecting forms against automated abuse. The web application cannot function properly without these cookies.
• 4.2 Preference Storage: Enables the web application to remember user-interface choices—such as your active workspace tab, theme mode, or same-tab sequence recovery references—so you do not lose work during a page reload.
• 4.3 Statistics & Product Analytics Cookies: Help us understand how workspace members interact with features in app.unravler.com (via PostHog US Cloud) so we can diagnose bottlenecks and improve reliability.
• 4.4 Marketing & Advertising Cookies: None. Unravler Outreach does not run third-party ad-network retargeting pixels or sell visitor browsing data to advertisers.

5. Cookie & Storage Declaration

The list below details the primary cookies and browser storage items used across www.unravler.com and app.unravler.com:

• session (HTTP-Only Cookie · First-Party · api.unravler.com): Strictly necessary. Maintains your authenticated backend session after Firebase token exchange. Expires upon sign-out or session timeout (up to 14 days).
• token / Firebase Auth Storage (Local Storage / IndexedDB · First-Party · app.unravler.com): Strictly necessary. Holds the short-lived Firebase ID token rotated hourly to authorize API requests for your workspace. Cleared immediately on Sign Out.
• cookie_consent (Local Storage · First-Party): Strictly necessary / Preference. Records your cookie banner acknowledgement choice so you are not prompted on every visit. Expiry: Persistent.
• ph_* (Cookie / Local Storage · PostHog Analytics · app.unravler.com): Statistics. Collects product usage telemetry and workspace reliability diagnostics when analytics is active. Expiry: Up to 1 year.
• cf_clearance / Turnstile Token (Cloudflare · Third-Party): Strictly necessary security token used to verify human interaction on authentication and password-reset endpoints. Expiry: Session / short-lived.

6. Third-Party Services & International Transfers

Certain authentication, security, and analytics providers (such as Google Firebase, Cloudflare, and PostHog US Cloud) process technical data on servers located in the United States or other jurisdictions outside your home country. Where personal data is processed by these providers, they apply standard contractual safeguards and security controls described in our Privacy Policy.

7. How to Control Cookies Through Your Browser

Most web browsers allow you to view, block, or delete cookies and site data through their “Settings,” “Preferences,” or “Privacy & Security” menus. You can also configure your browser to notify you each time a cookie is set. Please note that if you block or clear strictly necessary cookies or local storage on app.unravler.com, you will be signed out of your workspace and may need to sign in again.

8. Your Rights & Updates to This Policy

Because certain cookies involve the processing of technical or account identifiers, you have rights under applicable data protection law—including the rights of access, rectification, erasure, restriction, and objection—as described in full in Section 10 of our Privacy Policy.

We may update this Cookie Policy from time to time to reflect changes in our technology or legal requirements and will update the “Last updated” date at the top of this page. If you have any questions about our use of cookies, please email [email protected] or reach out via our Contact Us page.