The short version
- Necessary cookies only in the product and on published reports.
- Google Analytics on these marketing pages, and only after you accept.
- No advertising cookies and no cross-site tracking, anywhere.
- Your choice lives in your own browser and can be changed at any time.
A summary, not a substitute. The numbered sections below are the ones that bind us.
1.What we use, in one paragraph
Deliverd sets the cookies it needs to sign you in, remember which organisation you are working in, and prove to the origin serving a report that you are allowed to read it. Those cannot be switched off without breaking the product.
The only optional thing we set is Google Analytics, on these public marketing pages, and only after you accept. It never runs inside the product and never on a published report.
Change your mind any time on the cookie settings page.
2.Three places, three different rules
Deliverd runs on more than one hostname, and which cookies you meet depends on where you are.
- These marketing pages — the only place any optional or third-party cookie exists.
- The product, where you sign in and publish — strictly necessary cookies only, no analytics, no third parties.
- Published reports, served from a separate origin — one short-lived viewer cookie and nothing else. No analytics, no third-party scripts, and a content security policy that blocks outbound requests by default, so a report cannot quietly load a tracker either.
3.Strictly necessary cookies
These are set because the service cannot work without them, so they do not require consent and cannot be turned off in our settings. Blocking them in your browser will sign you out and stop reports from opening.
| Cookie | Where | Purpose | Lifetime |
|---|---|---|---|
sb-<project>-auth-token | Product | Keeps you signed in. Set by Supabase Auth, host-only to the product origin, and never sent to the origin that serves reports. | Until you sign out; refreshed as you browse |
dlv_org | Product | Remembers which organisation you are working in when you belong to more than one. | 1 year |
dlv_imp | Product | Present only during a read-only support session, and only in the browser of the support engineer — never in yours. See the Security page. | 1 hour maximum |
__Host-dlv_view | Published reports | Proves who you are to the origin that serves report content, so access can be re-checked on every request. HttpOnly, host-only and partitioned per site; it authorises nothing by itself. | 15 minutes |
4.Analytics cookies
We use Google Analytics to see how many people reach these pages and which ones they land on. Nothing is requested from Google — not even the script, which would disclose your IP address — until you press Accept.
| Cookie | Where | Purpose | Lifetime |
|---|---|---|---|
_ga, _ga_<id> | Marketing site | Google Analytics: counts visits and tells us which pages people arrive on. Set only after you accept, and only on these marketing pages. | 2 years |
Declining is one click, exactly like accepting, and you can withdraw consent later without penalty. We do not use advertising cookies, we do not build profiles, and we do not track you across other sites.
6.How to change your mind
Use the cookie settings page. The change applies immediately — accepting loads analytics on your next page view, and declining stops it at once.
Every browser can also block or delete cookies for a site, and clear local storage with them. That will clear your stored choice too, so we will ask again next time.
Anything unclear, or something in your browser we have not listed? Tell us at support@deliverd.dev.