Cookie policy

Last updated 13 August 2026

We set cookies to keep you signed in, and for nothing else. There is no consent banner on this site because there is nothing to consent to — no analytics, no advertising, no third-party tracking.

Draft — not yet reviewed by a lawyer. This was written to match how the product actually works, which is the hard part, but it has not been through legal review and it is not legal advice. Have counsel check it before you rely on it.

Why there is no cookie banner

Consent is required for cookies that are not strictly necessary. Every cookie we set is strictly necessary — take them away and you cannot stay signed in. So there is nothing to ask you about, and a banner asking anyway would be theatre.

If that ever changes, this page changes first and the banner arrives with it.

What we set

WhatWhyKept for
sb-<project>-auth-tokenYour Supabase session. This is what keeps you signed in to the dashboardUntil you sign out, or the session expires
sb-<project>-auth-token-code-verifierHolds the PKCE verifier for the few seconds between clicking a sign-in link and landing back on the siteDeleted as soon as the exchange completes

Both are set on our own domain and are read only by us. They are marked HttpOnly and Secure in production, so page scripts cannot read them and they never travel over plain HTTP.

What we deliberately do not set

No analytics cookies, no advertising or retargeting pixels, no social media widgets, no session recording. We do not use Google Analytics. The error tracker described in the sub-processor list runs without cookies and has session replay switched off — it records the DOM, and this product’s users are looking at exactly the sort of documents we promise never to collect.

Cookies and the SDK

The browser SDK you embed in your own application sets no cookies at all. It renders in the page, talks to our ingest API with an API key, and stores nothing locally. Adding screen2api to your site therefore adds nothing to your cookie policy.

Turning them off

Every browser can block or delete cookies. Block ours and the marketing site, the docs and the playground all keep working — you simply cannot sign in to the dashboard, because staying signed in is the only thing they do.

Contact