A full disclosure of every cookie and browser-storage item SpicaNova AI sets — and what it is used for.
Effective date: November 8, 2026
sn-design records which design of the app you chose. It is a cookie rather than browser storage because our server reads it to render the right oneSpicaNova AI does not use advertising, analytics, session-replay, A/B-testing, or cross-site tracking cookies. The only outside code that runs on our pages is Google's file picker, when you choose files from your Google Drive (see section 03). We do not show a cookie-consent banner.
Every cookie in the table below is either required for the product to work — keeping you signed in, protecting the flow that connects an integration, carrying a one-time invitation link to the screen that displays it — or records a display choice you made in the app. There is one of the second kind, sn-design, and it is marked as a preference rather than as strictly necessary because that is what it is.
We will add a cookie-consent interface if we ever introduce analytics or marketing scripts. We will update this page before that happens.
| Name | Type | Purpose | Expiry | Category |
|---|---|---|---|---|
| sb-<project>-auth-token | Cookie (httpOnly, Secure, SameSite=Lax) | Supabase session token — keeps you signed in to the SpicaNova app. Set by Supabase Auth on login; cleared on sign-out. It is split across numbered parts when it is too long for one cookie. | About 400 days after you last use the app. Cleared when you sign out. | Strictly necessary |
| sb-<project>-auth-token-code-verifier | Cookie (httpOnly, Secure) | PKCE code verifier: a one-time code that protects signing in, signing up and resetting a password. | Up to 400 days. Usually removed sooner: when the sign-in it protects completes, or when you sign out. | Strictly necessary |
| sn_oauth_state_<provider> | Cookie (httpOnly, Secure, SameSite=Lax) | Cross-site request forgery protection while you connect an integration. Set when you start the connection, checked when the provider sends you back, and cleared once it completes. | Short-lived (minutes) | Strictly necessary |
| sn_oauth_return | Cookie (httpOnly, Secure, SameSite=Lax) | Which screen to return you to once the provider hands you back at the end of connecting an integration. It holds one of two fixed values and never a path taken from the request. | Short-lived (minutes) | Strictly necessary |
| sn-design | Cookie (httpOnly, Secure, SameSite=Lax) | Which design of the app you chose, the current one or the earlier one. This is a cookie rather than a browser-storage preference because our server reads it to decide which design to render before the page reaches you — so unlike the preferences lower down this table, it does leave your device. It is set only when you choose a design. "Forget my choice", under the Design switch in the current design's account menu, deletes it. | 1 year | Preference / functional |
| __Host-sn_pending_invite (sn_pending_invite outside production) | Cookie (httpOnly, Secure, SameSite=Lax) | Holds a team invitation token across the sign-in step, so following an invitation link while signed out still lands you on that invitation rather than losing it. Cleared as soon as the invitation is accepted. | 30 minutes | Strictly necessary |
| sn_invite_link | Cookie (httpOnly, Secure, SameSite=Lax) | Carries the one-time invitation link you have just created to the Settings screen that shows it. It exists so the token travels in a cookie instead of in the address bar, where it would land in server logs and browser history. | 5 minutes | Strictly necessary |
| sn_invite_link_ws | Cookie (httpOnly, Secure, SameSite=Lax) | Which of your teams the invitation link above belongs to, so it is shown beside the right roster. | 5 minutes | Strictly necessary |
| sn-theme | localStorage (browser) | Your light/dark theme preference. Stays on your device, never sent to our servers. | Persistent (until cleared by you) | Preference / functional |
| spicanova-font-choice | localStorage (browser) | Your font-style preference. Stays on your device, never sent to our servers. | Persistent (until cleared by you) | Preference / functional |
| sn-layout-mode | localStorage (browser) | Which dashboard layout you last used. Stays on your device, never sent to our servers. | Persistent (until cleared by you) | Preference / functional |
| sn-accent | localStorage (browser) | The accent colour you picked for the app. Stays on your device, never sent to our servers. | Persistent (until cleared by you) | Preference / functional |
| sn-lab-accent | localStorage (browser) | The accent colour picked in the dashboard's own layout panel, which is a separate control from the one above and stores its answer under its own key. Stays on your device, never sent to our servers. | Persistent (until cleared by you) | Preference / functional |
| sn-lab-sidebar | localStorage (browser) | Whether you left the sidebar open or collapsed. Stays on your device, never sent to our servers. | Persistent (until cleared by you) | Preference / functional |
| lab.outreach.senderSetup.open | localStorage (browser) | Whether the sender-setup panel on the outreach page is expanded. Stays on your device, never sent to our servers. | Persistent (until cleared by you) | Preference / functional |
| sn-billing-banner-dismissed | sessionStorage (browser) | That you dismissed the billing notice at the top of the app, so it stays dismissed while you keep working. Stays on your device, never sent to our servers. | Until you close the browser tab | Preference / functional |
| Sentry (error reporting) | None (no cookie or browser storage) | Error monitoring. Sentry's browser code is part of the app your browser loads, but it is switched off: it never starts, sends nothing and sets no cookie. When error reporting to Sentry is switched on, it happens from our servers only, with personal fields removed first. We also keep our own copy of each error, with personal fields removed. | N/A — no device storage | Strictly necessary (reliability / security monitoring) |
SpicaNova AI does not embed any third-party analytics, advertising, social-media tracking, or session-replay scripts. One feature uses Google's code: when you choose files from your Google Drive, the app loads Google's file picker from accounts.google.com and apis.google.com. The picker belongs to Google and can use Google's own cookies. It loads only when you open it.
The Google OAuth consent screen (accounts.google.com) is served by Google and is subject to Google's Privacy Policy. SpicaNova does not control cookies set by Google during the OAuth authorization flow or in the file picker.
You can clear SpicaNova cookies and browser-storage items at any time using your browser's developer tools or privacy settings. Clearing the session cookie will sign you out. Clearing browser storage will reset your theme, font, layout and accent choices to the defaults. To clear only your design choice, press "Forget my choice" under the Design switch in the current design's account menu. The app then opens in its default design.
Blocking our cookies will prevent the signed-in product from working: the session cookie is what keeps you signed in, and connecting an integration needs the short-lived cookies that protect that flow. Blocking only sn-design costs you nothing but the choice of design. The public marketing pages do not require any cookies.
For questions about this disclosure, contact hello@spicanova.ai.