Cookie Policy

This policy explains how SmallForce ("we," "us," or "our") uses cookies and similar technologies on smallforcehq.com and our web dashboard at app.smallforcehq.com. Read it alongside our Privacy Policy, which explains how we handle personal information more broadly.

To change your analytics and advertising choice, open Cookie settings. Essential sign-in and preference storage remains available when you reject optional measurement.

1. What cookies and similar technologies do

Cookies are small pieces of information stored by your browser and sent with requests to the domain they belong to. We also use local storage, which keeps information in your browser between visits, and session storage, which normally lasts for the current tab. Pixels and event requests can send information about a visit or action to a measurement provider.

Some storage is set on a SmallForce domain, including identifiers used by analytics or advertising providers. Being a first-party cookie does not mean its information stays only with SmallForce. Providers may also use storage on their own domains when your browser interacts with them.

2. Why we use browser storage

• Sign-in, security, and requested services. Keep you signed in, protect sign-in flows, remember your cookie choice, prevent repeated audit requests, and let you return to a free audit report.
• Interface preferences. Remember dashboard views, expanded folders, selected advertising accounts, and open chat tabs. These settings support the interface and are not advertising identifiers.
• Product analytics. Use PostHog to understand visits, selected product actions, and the journey from signup to purchase.
• Advertising measurement. Use Meta Pixel and Conversions API, when enabled, to measure and improve SmallForce advertising.

3. Cookies and storage you may encounter

The entries below describe our current implementation. Which ones appear depends on the features you use, your choice, and which measurement services are enabled. Names may include a project or organization identifier.

SmallForce cookies and browser storage: purpose and duration

Storage / provider	Purpose	Duration
smallforce-platform.session_token SmallForce	Essential sign-in cookie. Secure deployments add the __Secure- prefix.	Up to 7 days per issue; renewed during continued use. Signing out ends the session.
smallforce-platform.state or smallforce-platform.oauth_state SmallForce	Protects an external sign-in flow. May also have the __Secure- prefix.	5 or 10 minutes, depending on the sign-in flow; normally cleared when the flow completes.
sf_advertising_prod SmallForce	Remembers your analytics and advertising choice across our website and dashboard.	180 days for acceptance; 400 days for rejection.
sidebar_state and dashboard view storage SmallForce	Remembers interface preferences. Chat tabs and popout state use session storage.	Sidebar cookie: 7 days. Local storage: until changed or cleared. Session storage: normally until the tab closes.
sf-audit-client, sf-gbp-audit, sf-gbp-audit-start SmallForce	Local storage for audit rate limits, report access, and safe request retries. Report access tokens are not sent to analytics.	No fixed browser expiry; until cleared or replaced. Pending request data is removed when resolved.
ph_<project-token>_posthog PostHog	Analytics cookie and local storage linking browser visits, sessions, and selected actions.	Cookie: 365 days per issue. Local storage has no fixed expiry.
__ph_opt_in_out_<project-token> PostHog	Local storage remembering the analytics SDK's capture choice when it has been loaded.	Until changed or cleared.
_fbc SmallForce / Meta	Stores a Meta click identifier when a visit contains a valid Meta click parameter and measurement is enabled.	90 days per issue.
_fbp Meta	Browser identifier created by Meta Pixel when enabled on eligible public pages.	Set and managed by Meta; see Meta's cookie policy.

Cookie lifetimes can restart when a cookie is renewed. Browser settings, private browsing, storage limits, or clearing site data can remove entries earlier. Browser expiry does not determine how long information already sent to our servers or providers is retained; see our retention and deletion information.

4. PostHog analytics

We use PostHog on our production website and dashboard for selected page views, signup-link clicks, completed registrations, and checkout starts. Browser and session identifiers connect visits across those surfaces; an account identifier connects signed-in activity. Events may include browser and device details, a simplified page route, campaign labels, and the referring domain. Confirmed payment events are sent from our server.

We do not enable session recordings or automatic form and click capture. Our analytics events exclude private workspace messages, documents, connected-app content, passwords, and access tokens. Development and preview sites do not send PostHog events. For provider information, see PostHog's privacy policy and browser storage documentation.

5. Meta advertising measurement

When enabled, Meta Pixel measures visits to selected public marketing pages. Our server integration reports events such as registration, checkout, subscription, and purchase. Matching can use browser identifiers, browser information, an account identifier, and a hashed email address. Hashing does not make information anonymous to a provider that can match it.

Measurement can include visits that did not originate from a Meta ad. We do not load Meta Pixel inside the private dashboard or send private workspace content in conversion events. Server event delivery does not require a Pixel cookie; the SmallForce advertising preference also controls this measurement. Read Meta's privacy policy for its use of information it receives.

6. How to manage your choices

Analytics and advertising measurement are on by default when enabled for the site, unless a saved opt-out or Global Privacy Control signal applies. They may therefore operate before you click a banner button. The banner offers Accept all and Reject all, and disappears after either choice is saved.

• Accept all allows the configured analytics and advertising measurement. Reject all turns it off. Essential sign-in, security, saved-choice, and requested interface functions continue to work.
• Reopen Cookie settings from the website footer or dashboard account settings to change your choice. The same setting covers PostHog and Meta; there are no separate provider switches.
• Your browser choice is shared across our production website and dashboard. When signed in, we also synchronize it with your account. If that synchronization cannot complete, a choice may apply only to that browser until it reconnects. A signed-out choice does not automatically apply to every device.
• We honor Global Privacy Control as an opt-out of this measurement. Acceptance is unavailable while that signal is active. Turning off the signal does not automatically reverse a saved rejection.
• Your browser can block or delete cookies and other site storage. Clearing storage can remove a signed-out preference, so you may need to choose again. Blocking essential storage can prevent sign-in or stop us remembering your choice.

Opting out stops future optional measurement; it does not recall events already sent or delete billing, security, or service records. To request deletion of personal information, contact support@smallforcehq.com.

7. Checkout, connected services, and customer sites

Dodo Payments handles our hosted checkout and may use its own storage for payments and fraud prevention. External sign-in providers and connected services have their own privacy and cookie notices. Our cookie setting does not control storage on those providers' domains.

This policy covers SmallForce's website and web dashboard. A website or application published by a SmallForce customer may use different cookies and should provide its own notice. Browser sessions used by AI employees to operate connected services are described in our Privacy Policy.

8. Updates and contact

We will update this page when our use of cookies or available controls changes and show the effective date above. For questions or help with a choice, email support@smallforcehq.com. Our Privacy Policy explains your information rights, and our Terms of Service cover use of SmallForce.