Cookies Policy

Cookies are small text files a website places on your device so it can remember things between visits. The same idea covers related technologies like localStorage and session storage; we treat them the same way and cover them in this policy.

These cookies are required for Atmita to work. You can't turn them off without breaking sign-in.

• `sb-access-token` / `sb-refresh-token` (Supabase): keeps you signed in. Session-scoped; expires when your session ends.
• `atmita-csrf`: protects form submissions against cross-site request forgery. Expires at end of session.
• `atmita-prefs`: remembers non-sensitive UI choices you make (theme, sidebar state). Up to 12 months.

These help us understand which pages and features are useful, in aggregate. They do not identify you personally.

• `_ga`, `_ga_*` (Google Analytics): aggregated page-view counts and session analytics. IP addresses are truncated before storage. Up to 24 months.

We do not run ad-tracking, retargeting, or cross-site behavioural advertising. We don't sell or share cookie data with ad networks.

If you block strictly necessary cookies, Atmita won't be able to keep you signed in and parts of the product will stop working.

• Browser settings: every major browser lets you block or delete cookies for individual sites; check your browser's privacy settings.
• Opt out of Google Analytics: install the Google Analytics opt-out browser add-on, or use a browser privacy mode.
• In the product: account-level cookie preferences live in Settings → Privacy.

Industry hasn't converged on a standard for Do Not Track, so we don't currently respond to the DNT header. We respect the Global Privacy Control (GPC) signal where supported: when we see it, we treat your session as opted-out of optional analytics and any future ad-network sharing.

If we add or change cookies, we'll update this page and the last-updated date at the top. Material changes are also announced in-product.