Cookies and browser storage

• cp_access_token and cp_refresh_token keep your signed-in session active. They are HttpOnly, SameSite=Lax, Secure in production; the access cookie follows the session expiry (one hour fallback) and the refresh cookie is set for 30 days.
• cp_pkce_verifier and cp_auth_next support sign-in and expire after 10 minutes.
• cp_gmail_oauth_state, cp_gmail_oauth_pkce and cp_gmail_oauth_user protect the optional Gmail authorization flow and expire after 10 minutes.

cp_marketing_consent_v1 remembers your optional analytics choice for 180 days in a first-party cookie shared across CommitPath subdomains. A copy is also stored in this browser’s local storage and may remain there until cleared or changed. These are preference storage; the consent choice itself does not enable tracking unless you accepted analytics.

Google may use its own cookies when you sign in or authorize Gmail. Checkout is handled by Stripe, which may use cookies or similar storage on its pages for payment and security. See Google’s Privacy Policy and Stripe’s Privacy Policy for their information. Those providers control their own storage and it does not change your optional CommitPath analytics choice.

After consent, PostHog may use cookies and local storage for analytics and eligible session replay. The cookies and storage used can vary with browser and provider configuration. Google Analytics 4 may set _ga and _ga_* cookies for up to 180 days; its event data is retained for two months.

You can reject or withdraw analytics at any time using Manage privacy choices. This stops future optional collection in that browser and removes supported first-party marketing cookies, but does not delete information already received by a provider. You can also clear cookies and local storage in your browser settings. Blocking essential cookies may prevent sign-in or requested features from working.

See the Privacy Policy for purposes, providers, rights and data retention. The browser’s built-in controls can remove stored cookies, but deleting your CommitPath account is a separate action in account settings.