Cookie Policy

DRAFT — Lawyer review required before production publication.

1. Scope

This Cookie Policy explains how Reels Factory uses cookies on our websites and applications. It applies to all visitors, whether anonymous, signed-in customers, or referral partners.

2. What we use cookies for

We currently use cookies only for strictly necessary platform functionality: authentication and signed-in sessions; CSRF and request security; referral attribution for the referral programme; short-lived onboarding and partner billing-preview state; and remembering that you have acknowledged this Cookie Policy via the on-site notice.

We do not use cookies for advertising, behavioural profiling, cross-site advertising tracking, analytics products, or the sale or sharing of cookie-derived personal information with third parties.

3. Cookies we set

Unless noted, cookies are first-party. Domain may be host-only or a configured parent domain for the active ingress host (public or local). Secure and SameSite follow deployment configuration (typically SameSite=Lax; Secure on HTTPS).

  • csrf_token — Site / shared CSRF middleware. Purpose: request forgery protection for state-changing requests. Path: /. Session cookie (no Max-Age). HttpOnly: false (readable by same-origin scripts). Strictly necessary.
  • session — Site authentication. Purpose: maintain a signed-in customer session. Path: /. Persistent: 12 hours. HttpOnly: true. Strictly necessary.
  • session_tmp — Site authentication. Purpose: provisional session during early sign-in/setup. Path: /. Persistent: 30 minutes. HttpOnly: true. Strictly necessary.
  • partner_session — Site partner portal. Purpose: maintain a signed-in referral partner session. Path: /. Persistent: 12 hours. HttpOnly: true. Strictly necessary.
  • referral_ref — Site referral flow. Purpose: attribute a referred signup to a partner. Path: /. Persistent: duration from referral programme cookie configuration (default 30 days; operator-configurable). HttpOnly: true. Strictly necessary for referral attribution.
  • onb_plan_id / onb_plan_slug — Site onboarding. Purpose: remember the selected plan across onboarding redirects. Path: /. Persistent: 2 hours. HttpOnly: true. Strictly necessary for onboarding.
  • partner_billing_preview_token_* — Site partner billing. Purpose: short-lived preview access token for a specific payout billing path. Path: scoped under /partners/payouts/{payout_id}/billing. Persistent: 30 minutes. HttpOnly: true. Host-only. Strictly necessary for that preview flow.
  • rf_cookie_notice — Site UI. Purpose: remember acknowledgement of this Cookie Policy / on-site notice (versioned opaque value such as v1). Path: /. Persistent: 180 days. HttpOnly: false. Host-only. SameSite=Lax; Secure on HTTPS. Strictly necessary for notice state.

Theme preference is stored in browser localStorage (not a cookie) and is not listed above.

4. Essential nature

These cookies are required for security and core product flows. Disabling them in your browser may prevent sign-in, CSRF-protected actions, referral attribution, onboarding, or partner billing previews from working correctly. Ordinary use of these essential cookies is not treated as optional marketing or analytics consent.

5. Managing cookies

You can delete or block cookies through your browser settings. If you clear cookies, you may need to sign in again and may see the cookie notice again until you press OK.

6. Contact and privacy rights

For privacy questions or rights requests, use the public Contact page or in-product support channels. Related notices are available under Privacy.

7. Updates

When our cookie practices change, we publish a new version of this policy through our legal document versioning system. The published version on this page is authoritative. The on-site notice may reappear when its acknowledgement cookie expires or when the notice version changes.