Cookie Notice
Last updated: November 11, 2026
Trailboss uses only cookies it needs to work: to keep you signed in, keep you secure and remember choices you make. There are no analytics, advertising or third-party tracking cookies, so we don't show a consent banner. If that ever changes, we'll ask first.
Cookies we set
| Cookie | Purpose | Lasts |
|---|---|---|
authjs.session-token (__Secure- prefix in production) |
Keeps you signed in. Encrypted; holds only your user id. | 30 days |
authjs.csrf-token, authjs.callback-url |
Protect sign-in from forged requests and return you to the right page. | Session |
tb_org |
Remembers which of your organizations you're working in. | Session |
tb_stepup |
Records that you recently confirmed a second factor, for sensitive actions. | 10 minutes |
tb_webauthn |
Holds a one-time passkey challenge while you sign in or confirm. | 5 minutes |
tb_share_* |
Remembers that you unlocked a password-protected preview link. | Until the link expires |
tb_operator, tb_impersonate |
Trailboss staff only: operator console sessions and support access, which customers can see in their audit log. | Up to 8 hours |
tb_demo_user |
The demo only: which sample person you're viewing as. | Session |
All are first-party, HttpOnly where the browser doesn't need to read them, and sent only over HTTPS in production.
Local storage
Your light or dark theme choice is saved in your browser's local storage (trailboss-theme). It never leaves your device.
Apps Trailboss hosts
Apps you build and publish run on a separate domain, so they can't read Trailboss's cookies. Cookies those apps set are their owners' responsibility.
Your choices
You can block or delete cookies in your browser settings. Blocking the cookies above will sign you out or stop sign-in from working.
Questions: support@trailboss.dev.