Cookie Policy
This is an inventory rather than a disclaimer: every key below was read out of the source, and there are no others.
Last updated: September 7, 2026
1. Summary
Support Frix sets no cookies. Not on the marketing site, not in the dashboard, and not in the embedded widget. Authentication uses a bearer token rather than a session cookie, and the API is configured to reject credentialed cross-origin requests entirely.
What the product does use is localStorage — six keys in total, listed below. Unlike a cookie, none of these are transmitted with HTTP requests; they stay in your browser until the code reads them or you clear them. There is no sessionStorage and no IndexedDB.
Keys written by the widget are namespaced per platform API key, so a site embedding two different platforms keeps them apart.
2. Strictly necessary
Without these the product cannot do the thing you asked it to do. Under the ePrivacy Directive these fall within the strictly-necessary exemption and do not require consent.
| Key | Set by | Purpose and lifetime |
|---|---|---|
| sf_admin_token | Dashboard | Your signed-in session. Without it the dashboard shows the sign-in screen. The token itself expires after 30 days; the stored value is removed when you sign out or when the API rejects it. |
| sf_ticket_<api-key> | Widget | The link token for the conversation you currently have open, so reopening the button returns you to it instead of a blank form. Cleared when you start a new request. |
| sf_identity_<api-key> | Widget | Your remembered contact details — either the name and email you typed, or your Telegram session token, ID, username and first name. It exists so you are not asked to identify yourself again on every message. The Telegram session token expires after 2 days. |
3. Functional
Preferences that improve the experience but are not required for it. They hold no identifier and are never read by anything but the page that wrote them.
| Key | Set by | Purpose and lifetime |
|---|---|---|
| sf-theme | Dashboard and site | Your light / dark / system choice. Read before first paint so the page does not flash the wrong theme. Removed when you switch back to “system”. |
| sf-sidebar-collapsed | Dashboard | Whether the navigation sidebar is folded to an icon rail. Persists until changed. |
| sf_history_<api-key> | Widget | Link tokens for up to your 25 most recent conversations on that site, so the widget can show a “your conversations” list on a device with no Telegram session. Persists until cleared. |
4. Analytical and marketing
None. This category is empty, and it is empty because the software contains nothing that would fill it. There is no analytics library, no advertising pixel, no session-replay recorder, no A/B testing framework and no error-reporting SDK anywhere in the dashboard, the API or the widget bundle.
The widget in particular ships no third-party code at all, which is worth knowing if you are embedding it: adding it to your site does not add a tracker to your site.
5. Third-party cookies
Two external services can set storage of their own, both tied to signing in and neither present on the public pages.
| Service | Where it loads | Why |
|---|---|---|
| Google Identity Services | The dashboard sign-in screen only, and only when the deployment has configured a Google client ID. | Renders the “Continue with Google” button and verifies the sign-in. Google may set cookies on its own domain during that flow, governed by Google’s privacy policy. |
| Telegram (OpenID Connect) | Only after you choose to continue with Telegram. | You are redirected to Telegram to authenticate. Any storage set there belongs to Telegram, under Telegram’s policies. |
Web fonts are compiled into this site at build time and served from the same origin, so browsing these pages makes no request to a font provider.
6. Why there is no consent banner
A consent banner exists to obtain permission before storing or reading information on your device for purposes that are not strictly necessary — chiefly analytics and advertising. This product performs no such processing.
The functional keys in section 3 store a display preference or a list of your own conversations, are readable only by the page that set them, and carry no cross-site identifier. Presenting a banner for those would be consent theatre rather than a real choice, so the storage is documented here instead.
If your own deployment adds analytics later, this page and the Privacy Policy must be updated and a consent mechanism added before that code ships.
7. How to clear this storage
Clearing site data for a domain removes every key above for that domain. In most browsers this is under Settings → Privacy → Cookies and site data, or via the storage panel in developer tools.
Specifically:
- Clearing storage for this site signs you out of the dashboard and resets your theme choice.
- Clearing storage for a site that embedsthe widget forgets your saved contact details and your open conversation on that device. Conversations already filed are unaffected and remain visible to that site’s support team.
- Blocking storage entirely still lets the widget send a message — the code treats unavailable storage as a normal condition — but you will be asked for your details again next time.
8. Contact
Questions about this inventory: info@frix.me.