Cookie Policy
This policy lists every cookie and every item TokenToko stores in your browser, what each one is for and how long it lasts. It covers our website tokentoko.ai, the dashboard at app.tokentoko.ai and the desktop app, which shows the dashboard in its own window. It is part of our Privacy Policy.
1. The short version
In short: no cookies on the website; the dashboard stores what it needs to sign you in, plus analytics only if you accept it.
tokentoko.ai sets no cookies. Framer, which hosts the site, counts visits without cookies. If you answer the cookie notice, your answer is stored in your browser.
The dashboard stores what it needs to keep you signed in and remember your settings. These items are necessary and can’t be turned off.
Analytics and session recording in the dashboard use PostHog, and only after you choose Accept in the cookie notice. That applies whether you are signed in or not, and in the desktop app. You can change your answer at any time.
2. What cookies and browser storage are
In short: small pieces of data a website keeps in your browser.
Cookies are small text files a website stores in your browser. Websites can also keep data in your browser’s local storage, session storage and IndexedDB. The law treats all of these the same way, so this policy lists them all and calls them “items”.
Necessary items are needed for something you asked for, such as staying signed in. We don’t need your consent for them. Analytics items help us understand how TokenToko is used. We use them only as described in section 5.
3. On tokentoko.ai
In short: one item, and only after you answer the cookie notice.
tt_cookie_notice
Type: Local storage, necessary
Purpose: Remembers whether you chose Accept or Reject in the cookie notice, so it doesn’t show again
Lasts: Until you clear your browser data
tt_cookie_notice_at
Type: Local storage, necessary
Purpose: When you answered the notice
Lasts: Until you clear your browser data
Framer counts page visits for us without cookies or other items in your browser. The site loads fonts from Google Fonts, which receives your IP address to deliver them.
4. In the dashboard and the desktop app
In short: sign-in, your settings and your analytics choice.
Firebase sign-in (firebaseLocalStorageDb)
Type: IndexedDB, necessary
Purpose: Keeps you signed in with your Google, Apple or Microsoft account. If IndexedDB isn’t available, local storage is used instead
Lasts: Until you sign out
tokentoko.auth.intentionalSignOut
Type: Session storage, necessary
Purpose: Notes that you chose to sign out, so you aren’t signed straight back in
Lasts: Until you close the tab
tokentoko.auth.events
Type: Local storage, necessary
Purpose: The last 30 sign-in steps, kept in your browser to help diagnose sign-in problems
Lasts: Until you clear your browser data
sidebar_state
Type: Cookie, necessary
Purpose: Remembers whether the side menu is open
Lasts: 7 days
theme
Type: Local storage, necessary
Purpose: Remembers dark or light mode
Lasts: Until you clear your browser data
tt-first-run-later
Type: Local or session storage, necessary
Purpose: Remembers that you postponed the getting-started prompt
Lasts: Until you clear your browser data, or the tab closes
tt_cookie_notice and tt_cookie_notice_at
Type: Local storage, necessary
Purpose: Your answer to the cookie notice, and when you gave it
Lasts: Until you clear your browser data
tt_analytics_account
Type: Local storage, necessary
Purpose: Remembers whether you turned analytics on or off for your account in Settings, in this browser
Lasts: Until you clear your browser data
ph_ items from PostHog
Type: Cookie and local storage, analytics
Purpose: An analytics ID and the current session, used for analytics and session recording
Lasts: Up to 1 year. Created only while analytics is on, and removed when you turn it off
The desktop app shows the dashboard in a built-in browser window, so the same items are kept in the app’s own browser storage on your computer.
When you buy something, Stripe’s checkout page opens on Stripe’s own website. Stripe sets its own cookies there, for example to prevent fraud, under Stripe’s privacy policy.
5. Analytics and session recording
In short: PostHog in the EU, secrets hidden, and you can turn it off.
We use PostHog, hosted in its EU region, to see which pages people use, where they get stuck and which errors happen. When analytics is on, PostHog records page views, clicks, errors, page performance and a recording of your session in the dashboard, including technical details such as console messages and the timing of network requests.
What is hidden. Recordings hide API keys, join tokens, pairing codes, the sign-in terminal used to connect a subscription and invitation links. Other people’s names and addresses are masked.
IP addresses. PostHog works out an approximate country and city from your IP address and then discards the IP address.
When it runs. Nothing is loaded or sent until you choose Accept in the cookie notice, whether you are signed in or not, and in the desktop app. If you choose Reject, or don’t answer, nothing is sent. If you are signed in and set analytics on or off in Settings, that choice takes priority over your answer to the notice in that browser.
Linking to your account. When you are signed in, analytics records are linked to your user ID, email address and name.
6. Your choices
In short: Settings, the cookie notice and your browser.
The cookie notice: choose Accept or Reject. Nothing is recorded unless you choose Accept.
Signed in: open Settings, then Privacy, and turn “Product analytics and session recording” on or off. This applies straight away, in the browser or app where you change it, so set it in each browser and in the desktop app you use.
Not signed in: to change your answer, use “Cookie settings” below the sign-in buttons.
Your browser: you can block or delete cookies and site data in your browser settings. If you block the necessary items, signing in won’t work.
7. Changes and contact
In short: we update this list when we change what we store.
We update this policy whenever we add, change or remove an item. The date at the top shows the latest version. Questions: privacy@tokentoko.ai.