Cookie Policy

1. What Are Cookies?

Cookies are small text files stored on your device (computer, smartphone, or tablet) when you visit a website. They let a site remember something about your visit from one page to the next, such as whether you are signed in.

Cookies can be:

• First-party cookies: Set directly by Klyverity
• Third-party cookies: Set by external services we use, such as our payment processor
• Session cookies: Temporary cookies that expire when you close your browser
• Persistent cookies: Remain on your device for a set period or until manually deleted

Every cookie Klyverity sets is a first-party cookie, and every one of them carries a fixed expiry. We set no advertising, profiling, or cross-site tracking cookies of any kind.

2. Why We Use Cookies

We use cookies for four things, and nothing else:

• Keeping you signed in as you move between pages
• Renewing your sign-in in the background, so a long working session does not drop you every 30 minutes
• Protecting your account against cross-site request forgery, where another site tries to make your browser act on your behalf
• Carrying you through two-factor authentication enrollment

We do not use cookies to remember interface preferences, to measure traffic, or to advertise. All four are named in Section 3.1.

3. Types of Cookies We Use

3.1 Essential Cookies (Required)

These four are the only cookies Klyverity sets. All four are first-party, all four are needed to sign in and stay signed in safely, and none of them can be turned off while you are using an account. The only other cookies you may ever see on klyverity.com come from Stripe, on the single screen that embeds Stripe's card field, and those are covered in Section 3.3.

What the Sent To column means. A cookie with a path is only attached to requests for that path, and nothing else. refresh_token is the one cookie that can mint a new session, so it is scoped to the single endpoint that renews sessions and is never sent with ordinary page loads or API calls. setup_token is scoped the same way to the two-factor endpoints. That is deliberate: it keeps the most powerful credential off nearly every request your browser makes.

Why csrf_token is readable by JavaScript. The other three are marked HttpOnly, meaning the page's own code cannot read them. csrf_token is deliberately not, and you will see it in your browser's developer tools. That is the design, not an oversight. It is the double-submit pattern: your browser attaches the cookie automatically, our page reads the same value and echoes it back in an X-CSRF-Token header, and the server accepts the request only when the two match. Another site can cause your browser to send the cookie, but it cannot read it, so it cannot produce the matching header, and the request is rejected. The value itself is 32 random bytes with no meaning. It is not a session, it grants no access, and knowing it does not let anyone act as you.

Why setup_token exists. FDA 21 CFR Part 11 is why two-factor authentication is mandatory on this Service and cannot be switched off, which means every new account passes through enrollment on the way in. During those few minutes you are in between: your password checked out, but no session exists yet, and we clear any session cookies before enrollment starts. setup_token is what holds that half-step. It lets you scan the authenticator code and confirm the first six digits, it is accepted only by the two-factor endpoints, and it expires in 30 minutes. It comes back if an administrator ever resets your second factor, since that puts you in the same in-between state.

All four are set on klyverity.com and its subdomains, so the website and the API share one session. All four use SameSite=Lax, which keeps your browser from attaching them to most requests another site makes, including anything embedded in another page and any form another site submits to us. Lax still sends them when you follow an ordinary link to us from somewhere else, which is what keeps that click from logging you out. On our production sites all four are also marked Secure, so they travel over HTTPS only.

3.2 Analytics (Optional, and Not Cookies)

We use Vercel Analytics and Vercel Speed Insights to count page views and measure how quickly pages load. Neither one sets a cookie, so there are no analytics cookies to list here.

They load only after you select Accept in our cookie banner. If you select Decline, or leave without choosing, they are never loaded and no analytics data is sent.

Your choice is saved in your browser's local storage under the name cookie-consent, not in a cookie. See Section 4.2 for how to change it.

3.3 Third-Party Cookies

One outside company can set cookies on klyverity.com, and only on one screen.

• Stripe: our payment processor. On the payment form shown when an organization ownership transfer requires the incoming owner to add a card, we embed Stripe's own card field so that card numbers go directly to Stripe and never reach our servers. Loading that field lets Stripe set its own cookies, which it uses for fraud detection. No other page in the Service loads it.
  Privacy Policy: stripe.com/privacy

Subscription checkout and the billing portal work differently: they send you to a page on Stripe's own domain, so any cookies there are Stripe's, set on Stripe's site, and governed by the policy linked above.

Our website is hosted by Vercel, whose privacy policy is at vercel.com/legal/privacy-policy. The only Vercel products that run in your browser are Vercel Analytics and Vercel Speed Insights, and neither sets a cookie (see Section 3.2).

4. How to Manage Cookies

4.1 Browser Settings

Most web browsers allow you to control cookies through their settings. You can:

• Block all cookies
• Block only third-party cookies
• Delete cookies when you close your browser
• Accept cookies from specific websites only

Here's how to manage cookies in popular browsers:

4.2 Opt Out of Analytics

Analytics is off unless you turn it on. Our cookie banner appears on your first visit, and Vercel Analytics and Vercel Speed Insights load only if you select Accept.

To change a choice you have already made:

• Clear the site data for klyverity.com in your browser. That removes the saved cookie-consent value, and the banner will ask again on your next visit
• Use a private or incognito window, where nothing is saved between sessions

5. Similar Technologies

Alongside cookies, the Service keeps a small amount of data in your browser's own storage. This is not cookie storage: unlike a cookie, nothing here is attached to network requests, so none of it is sent to our servers by the browser. It is listed here because it shows up next to cookies when you inspect the site, and because one of these entries is what remembers your analytics choice.

5.1 Local Storage

Local storage persists until it is cleared. We use these entries, and no others:

• cookie-consent: whether you selected Accept or Decline in our cookie banner. This is the entry that remembers your analytics choice, and it is browser storage rather than a cookie
• user: a copy of your name, email address, account type, and organization role, so pages can show who is signed in without a round trip to the server. It contains no password and no session token
• organization: the name and identifier of the organization you signed up with
• isNewUser: a one-time flag that triggers the welcome message on your first visit to the dashboard, then removes itself
• dashboard_checklist_dismissed and klyverity_rebrand_banner_dismissed: so that a checklist or banner you dismissed stays dismissed

Signing out removes the user entry. Clearing site data for klyverity.com in your browser removes all of them.

5.2 Session Storage

Session storage works the same way but is emptied when you close the browser tab. We use it only on the way in:

• setupToken and setupUser: held while you are enrolling in two-factor authentication
• redirectAfterLogin: the page you were trying to reach when you were asked to sign in, so we can return you to it afterwards

Signing out removes all three.

5.3 Web Beacons and Tracking Pixels

A web beacon, often called a tracking pixel, is a small or invisible image placed in a page or an email so that loading it reports back that you opened it. We do not use them on our website.

Our transactional emails (address verification, signature requests, reminders) carry one image that we put there, our logo, loaded from our own website, and the code that sends them passes no open-tracking or click-tracking option. They go out through Resend, our email delivery provider, whose account-level open tracking and click tracking are both off: we checked a delivered message and it carried no tracking pixel, and its links were left as we wrote them rather than rewritten to pass through a tracking domain. What remains is that any remote image in an email can reveal that the message was opened, and that is as true of our logo as of a deliberate tracking pixel. If that matters to you, most email clients can be set to block remote images, and the emails read perfectly well without it.

6. GDPR and Cookie Consent

If you are located in the European Economic Area (EEA), you have specific rights under the General Data Protection Regulation (GDPR):

• We place no non-essential cookies at all. The only cookies we set are the four in Section 3.1, which are strictly necessary to sign you in and keep the session safe
• You can withdraw consent at any time by clearing the site data for klyverity.com in your browser, which makes the banner ask again (see Section 4.2)
• Essential cookies do not require consent as they are necessary for the Service to function
• Analytics is opt-in: if you have not selected Accept in the banner, no analytics is loaded

7. Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature that signals to websites that you do not want to be tracked. Currently, there is no industry standard for how to respond to DNT signals.

Klyverity does not currently respond to DNT signals. However, you can control tracking through:

• Browser cookie settings (see Section 4.1)
• Declining analytics in our cookie banner (see Section 4.2)
• Using privacy-focused browsers or extensions

8. Updates to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in technology, legal requirements, or our practices. We will notify you of any material changes by:

• Posting the updated policy on this page
• Updating the "Last Updated" date
• Displaying a notification on the Service (for significant changes)

9. More Information

For more information about how we handle your data, please see:

• Privacy Policy - Comprehensive data protection information
• Terms of Service - Legal terms governing your use of the Service

10. Contact Us

If you have questions about this Cookie Policy or how we use cookies, please contact us: