Cookie Policy

1. What this policy covers

This policy explains the cookies used on both Capmatter surfaces - the marketing website (capmatter.com) and the Capmatter app (app.capmatter.com), including its employee and investor portal - which share a single sign-in session across one apex domain.

2. Cookies we use

Strictly necessary - authentication

We use Supabase Auth session and refresh-token cookies to keep you signed in. These are set on the shared apex domain so that signing in on the marketing website keeps you signed in on the Capmatter app without signing in again.

• Purpose: authenticate requests, maintain your signed-in state, protect against cross-site request forgery.
• Attributes: SameSite=Lax, Secure in production, scoped to the shared Capmatter domain.
• Lifetime: tied to your Supabase session and refresh-token lifetime - cleared on sign-out, and invalidated immediately if you delete your account or trigger a security-related session revocation.
• Third party: no - set and read only by Capmatter's own servers via Supabase, our authentication infrastructure provider.

Strictly necessary - preferences

A small local preference (such as light/dark theme) may be stored in your browser to avoid a flash of the wrong theme on load. This never leaves your device and is not used for tracking.

Optional - privacy-friendly analytics (website only with your permission)

We use Vercel Web Analytics to count page views and see which pages are used. It sets no cookies, stores nothing on your device, and does not collect personal data or follow you across sites; visits are counted in aggregate.

• Marketing website (capmatter.com): analytics loads only if you choose "Allow analytics" in the banner. If you decline, it never loads.
• Capmatter app (app.capmatter.com): the same cookieless analytics runs for signed-in users to keep the product reliable and usable, as described in our Privacy Policy.

What we do NOT use

• No advertising or marketing cookies
• No cross-site behavioral tracking
• No cookie-based analytics trackers (Google Analytics, Meta Pixel, etc.)
• No fingerprinting

3. Why the authentication cookie isn't marked httpOnly

Some of the app's guided workflows (for example, issuing shares or drafting a grant) write directly from your browser to our database, where row-level security decides what each account may change. That requires the session cookie to be readable by that client-side code. This is a deliberate, documented tradeoff, not an oversight - it is compensated by SameSite=Lax (which blocks the cross-site request patterns that tradeoff would otherwise expose you to), enforced HTTPS in production, and server-side authorization checks on every write that never trust the cookie's mere presence alone. See our Security Policy for more detail.

4. Your choices

The sign-in cookies are strictly necessary, so they are not optional: you accept them by creating an account and signing in, as described in our Privacy Policy. Analytics on the marketing website is optional, and the banner asks before it loads. Your choice is kept in your browser's local storage (not a cookie); clear your site data to be asked again.

5. Managing cookies

You can clear or block cookies through your browser settings at any time. Doing so will sign you out of Capmatter and prevent you from staying signed in until you sign in again.

6. Changes to this policy

If we ever introduce a new category of cookie or tracking, we will update this policy and ask for your consent before using it where it is optional.

7. Contact

Questions about this Cookie Policy: support@capmatter.com.