Cookie Policy
Last updated: August 21, 2026
This Cookie Policy explains how Stand 8 ("Stand8," "we," "us," or "our") uses cookies and similar technologies on stand8.ai and its subdomains.
1. What Are Cookies?
Cookies are small text files stored on your device when you visit a website. They help websites remember your preferences and enable various features. Similar technologies include localStorage (browser-based storage) and analytics scripts.
2. Cookies We Use
2.1 Essential Cookies (Required)
These cookies are necessary for the Site to function and cannot be disabled.
| Cookie Name | Purpose | Duration |
|---|---|---|
sb-<project-ref>-auth-token[.<chunk>] / ai-assessment-supabase-client[.<chunk>] | Supabase SSR authentication session cookies used to keep you signed in and refresh the session. Large values may be split into numbered cookie chunks. The SDK rewrites them during token refresh and clears them on sign-out; the authenticated session may end sooner under server session policy. | SDK default: up to 400 days; browser or session policy may shorten |
<auth-storage-key>-code-verifier / <auth-storage-key>-flow-<flow-id>-code-verifier / <auth-storage-key>-flows-code-verifier | Essential PKCE authentication-flow state. These cookies are normally removed after authentication completes or auth state is cleared. | SDK default: up to 400 days; normally shorter |
cookie_consent | Stores your cookie consent preference | 365 days |
assessment-progress-resume | HttpOnly credential used to resume server-saved assessment progress | 7 days |
assessment-attempt-* | Attempt-specific HttpOnly credential for an active assessment | Up to 24 hours |
assessment-pending-claim | Short-lived HttpOnly link between an assessment and a later sign-in | 15 minutes |
__Host-assessment-result-session | Keeps unlocked assessment results available in the same browser without exposing the credential to client-side scripts | 365 days |
__Host-workspace-invite | Short-lived HttpOnly workspace invitation exchange credential | 10 minutes |
workspace-organization | HttpOnly selection of the active workspace organization | Session |
2.2 Analytics Cookies (Optional)
Optional analytics technologies help us understand how visitors use our Site. Before you choose, neither provider collects analytics. Choosing "Essential Only" keeps both providers disabled; choosing "Accept All" enables Vercel Analytics and PostHog.
| Cookie / Script | Provider | Purpose |
|---|---|---|
| Vercel Analytics script (no analytics cookie) | Vercel | Page view tracking after you accept analytics. Vercel Analytics does not set an analytics cookie. Before sending, we remove query strings and replace dynamic assessment, result, and attempt identifiers with pseudonymized route templates. We do not intentionally send raw assessment identifiers; Vercel may process pseudonymous visitor and platform metadata, and its temporary visitor hash is discarded after 24 hours. |
ph_<project-token>_posthog / __ph_opt_in_out_<project-token> | PostHog, Inc. (US) | Named product and conversion events after you accept analytics cookies. A signed-in account ID may link activity after consent. After Accept all, we attach your email as a person property when you submit it or sign in. Event payloads do not include email, answers, name, or phone. Automatic pageview capture, autocapture, exception capture, Core Web Vitals performance metrics (such as LCP, CLS, and INP), and session replay with form inputs masked are enabled. After Accept all, assessment events captured on our servers include a session identifier so they can be linked to the originating browser replay. The PostHog persistence cookie defaults to 365 days. |
3. Browser Local Storage
The table below describes primary localStorage entries used by the public Site. Browser libraries and authentication flows may also create short-lived or version-specific entries. Supabase SSR authentication state is stored in the essential cookies described above, not in localStorage.
| Key | Purpose |
|---|---|
assessmentProgress | Saves assessment answers and progress in the legacy assessment flow until submitted or cleared |
assessmentAttemptDraft:<attempt-id> | Bounded local fallback for an in-progress attempt; expired fallbacks are swept after 7 days |
assessmentQuickAttempt:v2:<scope> | Quick-assessment request and event continuity, valid for up to 24 hours |
assessmentRequest:<assessment-id>:full | Idempotency identifier that prevents duplicate full-assessment submissions |
cookie_consent / cookie_consent_ts | Stores your cookie consent preference and the timestamp it was set |
ph_<project-token>_posthog / __ph_opt_in_out_<project-token> | After Accept All, PostHog stores analytics identity and consent state in localStorage. Both PostHog entries are cleared when you withdraw analytics consent or clear browser storage. Stand8's essential cookie_consent key records the resulting Essential Only choice. |
assessmentAnonymousId | Anonymous identifier for assessment funnel progress before an account exists |
stand8.retroTerminal.deviceId | Device identifier for the optional retro-terminal easter egg |
theme | Stores your theme preference (dark/light mode) |
4. Third-Party Cookies
We do not use third-party advertising cookies or tracking pixels. Our third-party integrations include Supabase, Vercel, and PostHog. Deployment infrastructure may add strictly necessary security technologies depending on the environment.
5. Managing Cookies
You can manage cookies through:
- Our consent banner: when you first visit the Site, you can choose "Accept All" or "Essential Only." The Cookie preferences button in the site footer lets you change that choice later. Starting the Agentic Readiness Assessment records Accept All and replaces Essential Only. Essential Only disables Vercel Analytics and PostHog named events and clears PostHog identity and analytics persistence.
- Your browser settings: most browsers allow you to block or delete cookies. Note that blocking essential cookies may prevent parts of the Site from functioning correctly.
Withdrawing analytics consent does not remove essential authentication or result-access cookies. Removing the result-session cookie re-gates unlocked assessment results in that browser; you can unlock them again through the result page.
Browser-Specific Instructions
6. Changes to This Policy
We may update this Cookie Policy as our technology or legal requirements change. Updates will be posted on this page with a new "Last updated" date.
7. Contact Us
For questions about our use of cookies:
- Stand 8
- Email: privacy@stand8.io
- Website:stand8.ai