Cookies

• StatementReady uses only strictly necessary first-party cookies, to keep you signed in and to enforce multi-factor authentication.
• In production, sign-in runs on Supabase Auth. The session cookie is set on statementready.net. Supabase's default name is sb-[project-ref]-auth-token. A large session may be split into numbered parts (.0, .1, and so on). Sign-in may briefly set a related code-verifier cookie.
• The session cookie holds the sign-in session. It ends on sign-out or when a security event ends the session.
• A separate cookie, sr_session, is used only for local development sign-in. It is not used in production.
• Borrower upload pages do not set a sign-in cookie.
• We do not set analytics, advertising, or tracking cookies. PostHog is not used in production. Stripe may set its own cookies on Stripe-hosted checkout and billing pages, under Stripe's policy.

Privacy Policy