1. Scope
This notice explains browser storage and related technologies used in connection with Cossad, operated by William Zun Park. Read it with the Privacy Notice. Questions and privacy requests may be sent to info@cossad.com; operational questions may be sent to info@cossad.com.
Cookies are small browser records. Local storage, session storage, embedded components, request identifiers, and server-side records can serve related purposes but are not all cookies. A database record is not automatically deleted when a browser cookie expires.
2. Necessary authentication and workspace storage
Cossad uses necessary authentication and security mechanisms to recognize an authenticated session, protect account actions, and select a business workspace. They do not by themselves authorize access to another business's data.
The following describes the Cossad-controlled mechanisms relevant to the launch service:
| Mechanism | Purpose and data | Duration and controls |
|---|---|---|
| Authentication session cookies managed by Better Auth | Opaque session credentials and related authentication state; used to identify a valid signed-in session, not to store a full bank account or card number | The application session is configured for seven days and can be renewed during use. Exact cookie names, secure prefixes, and any short-lived auxiliary cookies depend on the deployed authentication configuration. Sign-out, revocation, expiration, and browser deletion can end browser access. The seven-day setting is not a promise that all server logs are deleted after seven days. |
xf-org | The selected business workspace identifier; the server separately verifies membership and permissions | Set as a session cookie without a fixed application expiry in the reviewed implementation. Browser session restoration can affect how long a session cookie remains. Switching workspace or signing out changes the relevant session behavior. |
| Temporary authentication or security state | Preventing request forgery, completing a selected sign-in flow, rate limiting, and resisting abuse | Limited to the relevant security purpose. Some controls are server-side rather than browser cookies. |
Necessary cookies may be used without optional-cookie consent where the applicable law permits the necessary-use exception. We do not classify a technology as necessary merely because it is commercially useful.
3. Payments, bank connection, and external sign-in
When you choose a payment, saved-card, Stripe Connect, Link, or Financial Connections function, the official provider interface may use its own authentication, fraud-prevention, bank-connection, and preference technologies. Similarly, a selected Google or Apple sign-in flow is subject to that provider's interface and privacy information.
Those providers can process browser, device, connection, and interaction information under their applicable notices. Whether a technology is set on Cossad's page or on a provider's page depends on the selected flow. A redirect to Stripe does not make all subsequent Stripe cookies Cossad cookies, and Cossad does not control all provider settings. Consult the notice offered in the actual provider flow. Do not enter bank passwords or verification codes into a Cossad support message.
Cossad does not request permission to read your bank's transaction history merely because you connect a payout account. Any additional bank-data permission must be actually requested, described, and supported in the selected official flow.
4. Optional technologies and personalization
The launch policy is not to enable optional advertising, cross-site tracking, session-replay, or nonessential analytics technologies before they have been inventoried, legally reviewed, and, where required, activated through an affirmative choice. An inventory or cookie-control screen must describe actual technologies; a generic banner is not proof that tracking is disabled.
When optional browser technologies are offered, you may accept or reject them by category, with rejection as easy as acceptance, and change the choice through Cookie settings. Choosing to reject optional processing must not block necessary account functions. Turning a choice off stops future optional use subject to the disclosed technology; it does not automatically erase every previously generated business or security record.
Buyer inventory-interest personalization and recommendation emails are separate account preferences. When enabled, the application can record selected product-interest activity against the account in its database. This is not made anonymous merely because no advertising cookie is used. Turning off personalization uses the available account control to stop that optional collection and remove the relevant interest records; email-digest preferences are separate from necessary order and security notices.
We do not treat use of a page, scrolling, a preselected checkbox, or silence as consent where affirmative consent is required.
5. Browser choices and signals
Your browser can block or clear cookies and similar storage. Doing so may sign you out or remove your workspace preference. Provider-controlled bank or payment flows may not work if their necessary security technologies are blocked. Browser controls do not necessarily withdraw a server-side marketing subscription; use the relevant account or unsubscribe control as well.
Cossad does not currently use the legacy Do Not Track header as an application-level preference switch. This is distinct from Global Privacy Control or another legally recognized opt-out preference signal. Where such a signal creates a legal obligation for processing we conduct, we must honor that obligation and may not disregard it merely because the legacy Do Not Track header is unsupported. The launch service does not offer optional advertising activation as a way to bypass a legally binding opt-out.
6. Changes and actual inventory
We update this notice and the actual technology inventory before introducing materially different optional technologies. Provider technologies can change; material Cossad-controlled changes require review rather than automatically inheriting a previous consent. The Privacy Notice explains collection, recipients, retention criteria, and rights beyond browser storage.