Cookie Policy
What cookies involy sets, why, and how to control them. Short version: we keep it minimal and we have zero advertising trackers.
In plain English: involy uses a small number of cookies that are strictly necessary to keep you signed in and to make the application work. We do not use advertising cookies, cross-site trackers, or any cookies that share your data with third-party ad networks.
What cookies are
Cookies are small text files that a website stores on your device when you visit. They are used for a wide range of purposes — from keeping you logged in, to remembering your preferences, to tracking your behavior across the web for advertising purposes.
involy only uses cookies in the first two categories. We do not engage in cross-site behavioral tracking.
Beyond cookies, web applications also commonly use browser-native storage ("localStorage" and "sessionStorage") for client-side state. Where involy uses these mechanisms, they function equivalently to functional cookies and are subject to the same principles described here.
Cookies we use
The table below lists the categories of cookies involy sets. We do not use third-party advertising or tracking cookies.
| Category / Name | Purpose | Duration |
|---|---|---|
| Session auth cookie Essential | Keeps you signed in across page loads and browser tabs. Contains an encrypted session token — no personal data is stored in the cookie itself. The token is verified server-side on every authenticated request. | Session (expires when you sign out) or up to 30 days if you choose "stay signed in." |
| CSRF protection token Essential | A security token that prevents cross-site request forgery (CSRF) attacks. Required for any form submission or state-mutating operation. | Session. |
| Stripe payment cookies Functional / third-party essential | When your client uses the Stripe-hosted payment page, Stripe may set cookies for fraud detection and checkout state. These are essential for secure payment processing and are governed by Stripe's Cookie Policy. | Varies (set by Stripe, not involy). |
| Preference storage Functional | Lightweight browser localStorage entries (not cookies) that remember UI state — for example, which sidebar panel you last had open or your preferred date range in a report. No personal data. | Persists until you clear browser storage or use a different device. |
What you will not find here: Google Analytics, Facebook Pixel, LinkedIn Insight, or any other third-party advertising or behavioral tracking script. None.
Why we use them
The essential cookies (session auth, CSRF token) are necessary for the service to function. Without them, you could not stay signed in, and form submissions could not be protected against cross-site attacks. There is no way to use involy without these cookies — they are not optional.
The functional preference storage is optional in the sense that disabling localStorage will not prevent you from using involy, but the application may not remember your UI preferences between visits.
We have deliberately chosen not to use analytics cookies or advertising pixels at this stage of the product. We rely on aggregate server-side logs (IP addresses, endpoints visited) for operational insight rather than client-side tracking scripts.
Managing cookies
You can control and delete cookies through your browser settings. Most modern browsers let you:
- View the cookies set by a specific site.
- Block all cookies or only third-party cookies.
- Delete cookies individually or all at once.
- Set cookies to expire when you close the browser.
Instructions for common browsers:
Note: blocking or deleting the session auth cookie will sign you out of involy. Blocking the CSRF token cookie may prevent form submissions from working. Because our essential cookies are necessary for the service to function, blocking them is the functional equivalent of not using involy.
Do Not Track
Some browsers send a "Do Not Track" (DNT) signal to websites to indicate that you prefer not to be tracked across sites. involy respects the spirit of this preference: we do not engage in cross-site tracking regardless of whether a DNT signal is present.
Because we do not use advertising trackers or behavioral analytics scripts, the DNT signal has no practical effect on our cookie behavior — we are already operating in a minimal-tracking mode by default.
Changes
We may update this Cookie Policy if we add new functionality that requires additional cookies (for example, if we add an opt-in analytics integration in the future). When we do, we will update the effective date above and, if the change is material, notify you via your account email.
If we ever add advertising or third-party behavioral tracking cookies, we will implement a consent mechanism before setting them. That is a firm commitment.
Contact us
Questions about this document or your data? We read every message.
involy / ThinkOpen Inc.
5420 McConnell Ave, Los Angeles, CA 90066
Privacy: privacy@involy.app
Legal: legal@involy.app
Security: security@involy.app
This document is provided for transparency and is not legal advice. involy is in early access; we will post material changes here and, where required, notify you directly.