Cookie policy
Last updated 13 August 2026
We set cookies to keep you signed in, and for nothing else. There is no consent banner on this site because there is nothing to consent to — no analytics, no advertising, no third-party tracking.
Why there is no cookie banner
Consent is required for cookies that are not strictly necessary. Every cookie we set is strictly necessary — take them away and you cannot stay signed in. So there is nothing to ask you about, and a banner asking anyway would be theatre.
If that ever changes, this page changes first and the banner arrives with it.
What we set
| What | Why | Kept for |
|---|---|---|
| sb-<project>-auth-token | Your Supabase session. This is what keeps you signed in to the dashboard | Until you sign out, or the session expires |
| sb-<project>-auth-token-code-verifier | Holds the PKCE verifier for the few seconds between submitting the sign-in form and the session cookie being set | Deleted as soon as the exchange completes |
Both are set on our own domain and are read only by us. They are marked HttpOnly and Secure in production, so page scripts cannot read them and they never travel over plain HTTP.
What we deliberately do not set
No analytics cookies, no advertising or retargeting pixels, no social media widgets, no session recording. We do not use Google Analytics.
We do measure which pages are visited and how quickly they load, using Vercel’s Web Analytics and Speed Insights. Both are cookieless: they set nothing on your device, assign no identifier that follows you between visits, and cannot be used to recognise you on another site. That is why they do not appear in the table above — there is no cookie to list. Vercel already hosts this site, so no new company sees anything.
The error tracker described in the sub-processor list runs without cookies and has session replay switched off — it records the DOM, and this product’s users are looking at exactly the sort of documents we promise never to collect.
Cookies and the SDK
The browser SDK you embed in your own application sets no cookies at all. It renders in the page, talks to our ingest API with an API key, and stores nothing locally. Adding screen2api to your site therefore adds nothing to your cookie policy.
Turning them off
Every browser can block or delete cookies. Block ours and the marketing site, the docs and the playground all keep working — you simply cannot sign in to the dashboard, because staying signed in is the only thing they do.