Three cookies keep you signed in and protect forms. Two local storage keys remember your preferences. Analytics is cookieless and optional. We use no advertising or tracking cookies at all — so there is nothing here following you around the web.
Strictly necessary
These make the product work. Without them you cannot stay signed in and submitting a form would not be safe, so they are not subject to consent — refusing them would mean refusing the service.
| Name | Purpose | Lasts | Set by |
|---|---|---|---|
auth-token | Keeps you signed in. HttpOnly, so it cannot be read by scripts in the page. | 8 hours | FullArc |
auth-refresh | Renews your session without making you sign in again. HttpOnly, and revocable — signing out everywhere invalidates it. | 30 days | FullArc |
csrf-token | Proves a form or action came from FullArc and not from another site acting as you. Readable by the page, because the page must send it back. | 24 hours | FullArc |
fullarc_consent | Remembers this cookie choice. Stored in local storage rather than a cookie, and never sent to our servers. | 1 year | FullArc |
lastDashboardPath | Returns you to the screen you were last on. Stored against your account so it is never replayed to anyone else who signs in on this device, and cleared when you sign out. Local storage, on your device only. | Until you sign out | FullArc |
The last two are stored in your browser's local storage rather than as cookies. Local storage is never transmitted with your requests, so those values stay on your device — we list them here anyway, because from your side the distinction matters less than knowing what is being kept.
Analytics
We measure page views with Vercel Web Analytics, chosen specifically because it is cookieless. It stores no identifier on your device, sets no cookie, and does not follow you to other sites. There is nothing in the table below because there is nothing to list.
We use it to see which pages people actually read. Turning it off in your cookie choices prevents the script from loading at all — the request is never made, rather than made and ignored.
Advertising and marketing
None. FullArc sets no advertising cookies, runs no ad network pixels, embeds no social tracking widgets, and does not build a cross-site profile of you.
This is not a gap waiting to be filled. If it ever changes, this page changes with it and the consent banner will ask you again before anything new is set.
Your choices
You chose when you first arrived, and you can change it whenever you like — there is no penalty for saying no, and the product works the same either way.
We ask again after a year. A decision made on a device two years ago is not a current one.
Controlling cookies in your browser
Every major browser lets you view, block and delete cookies in its privacy settings. Be aware that blocking the strictly necessary ones will sign you out and prevent you signing back in — that is a limitation of what those cookies do, not a choice we are making for you.
Questions
Anything unclear, or something you think we have missed? Write to privacy@getfullarc.com. Our Privacy Policy covers everything beyond browser storage.