CoWork Cookie Policy

This policy explains the cookies, local storage and similar technologies used on cowork.live, app.cowork.live, cowork.live, app.cowork.live and the CoWork apps, and how to control them. It forms part of the Privacy Policy.

What we use and why

Strictly necessary (always on)

These are needed for the Service to work. Most are stored in your browser's local storage rather than as cookies.

• token: keeps you signed in. Until you sign out, or 90 days.
• theme, language: remember your display preferences. Persistent.
• livekitAnonymousUserId and related: identify an anonymous participant so time limits and moderation apply. Persistent.
• Registration and deletion markers: prevent immediate re-registration after a ban, underage block or deletion. 90 days after registration, and for a short period after deletion.
• livekitSettings, drafts, widget positions and similar: remember in-app settings and unsent drafts. Persistent.
• socketConnectionId: keeps your real-time connection in step across tabs. Session.
• consentDecision: remembers your cookie choice and when you made it. Until you change it, or until the cookie policy changes in a way that needs a new decision.
• Google reCAPTCHA (_GRECAPTCHA): protects registration from bots. 6 months.
• Stripe (__stripe_mid, __stripe_sid): fraud prevention during checkout. 1 year, 30 minutes.
• Datadog (_dd_s): groups the error logs from one browser session so we can diagnose faults. Session. No session replay.
• GrowthBook (gbuuid): a random identifier so you keep seeing the same version of a feature. Persistent. Recording that you saw an experiment is separate and needs your analytics consent.
• ReproKit (@reprokitapp/browser-sdk.anon_id, …session_id): our own bug-diagnostics tool; a random identifier in local storage and a session identifier in session storage so error reports from one visit can be grouped. Persistent and session.

Analytics and performance (consent)

In the UK, the EEA, Switzerland and Monaco (and their territories), set only after you accept analytics cookies in the banner. Elsewhere, set by default unless your browser sends a Global Privacy Control (GPC) signal; you can turn them off from the Cookies link in the footer.

• PostHog: product analytics in the web app. Local storage and a ph_…_posthog cookie. 1 year.
• Google Analytics: traffic measurement. _ga, _ga_*. 2 years.
• Hotjar: heatmaps, session recordings and occasional surveys. _hjSessionUser_*, _hjSession_* and others. Up to 1 year.
• GrowthBook experiment exposures: records which experiment version you saw. Uses the identifiers above; no extra cookie.

Advertising measurement (consent)

In the UK, the EEA, Switzerland and Monaco (and their territories), set only after you accept marketing cookies in the banner. Elsewhere, set by default unless your browser sends a Global Privacy Control (GPC) signal; you can turn them off from the Cookies link in the footer.

• Meta Pixel: measures sign-ups and purchases from Meta ads and builds ad audiences. _fbp, _fbc. 3 months.
• OpenAI (ChatGPT ads): measures sign-ups and purchases from our ads in ChatGPT. __obref, __oppref. Duration set by OpenAI.

We do not show advertisements on the website or the web app, and no advertising-network cookies are set there.

Mobile apps

The apps do not use cookies. They use these identifiers instead:

• Advertising identifier (IDFA on iPhone, GAID on Android), used by Meta, RevenueCat and Google AdMob to measure which ads led to installs and purchases and to deliver ads. iPhone: the "allow tracking" prompt, and Settings > Privacy > Tracking. Android: Settings > Google > Ads > Delete advertising ID.
• Vendor or app instance identifier, used by RevenueCat, Firebase and Amplitude to keep your purchases and analytics consistent across sessions. Uninstalling the app resets it.
• Push token, used by Firebase Cloud Messaging to deliver notifications. Notification settings in the app or phone.

Loaded only when you use them

• Chatwoot: support chat; loads when you open it and keeps your conversation. Set by the provider.
• Featurebase: feedback portal widget; loads when you open it. Set by the provider.
• YouTube, Vimeo: vibes videos and break videos. Set by the provider when a video plays.
• Arcade: interactive product tours for new members. Set by the provider.

Managing your choices

• Use the Cookies link in the footer to accept or turn off the optional categories at any time, wherever you are.
• Your browser lets you block or delete cookies and site data. Blocking strictly necessary storage will sign you out and may stop rooms working.
• In the mobile apps, members can turn off ads by upgrading to a paid plan.
• Google: tools.google.com/dlpage/gaoptout. Meta: adjust your ad preferences in your Facebook or Instagram account settings. Hotjar: hotjar.com/policies/do-not-track.

Contact

Knowledge Collective Ltd, 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom. team@cowork.live