Cookie Policy
Last updated: August 5, 2026
1. The Short Version
By default PulsAPI stores only first-party, strictly-necessary cookies, the ones that keep you signed in, plus a few local-storage entries for preferences like your theme. None of those require consent under the GDPR or the ePrivacy Directive.
We also use Google Analytics 4 to understand which pages people actually use. It is off until you accept it: until then it stores nothing on your device and sends no identifiers, and if you choose “Essential only” it stays that way. We do not use advertising cookies, cross-site trackers, or remarketing, and Google's advertising features are disabled for this property.
2. What We Store, Exactly
| Name | Type | Purpose | Duration | Category |
|---|---|---|---|---|
| pb_access | Cookie (httpOnly) | Short-lived session token that keeps you signed in. Sent only to our API, never readable by JavaScript. | 15 minutes | Strictly necessary |
| pb_refresh | Cookie (httpOnly) | Long-lived token used to silently renew your session so you don't have to sign in every 15 minutes. | 45 days | Strictly necessary |
| pb_token / pb_user | Local storage | Fallback session token and cached profile for API clients and environments without cookie support. Cleared on sign-out. | Until sign-out | Strictly necessary |
| theme | Local storage | Remembers your light/dark appearance preference. | Until cleared | Functional |
| pb_consent | Local storage | Records the privacy choices you made in the consent notice, so we don't ask again and can honor them. | Until cleared | Strictly necessary |
| _ga | Cookie (Google Analytics) | Set only if you accept analytics. Distinguishes one browser from another so we can count visitors and see which pages get used. | 2 years | Analytics (opt-in) |
| _ga_B267JFZ8X6 | Cookie (Google Analytics) | Set only if you accept analytics. Keeps track of the current session so a visit isn't counted twice. | 2 years | Analytics (opt-in) |
Auth cookies are httpOnly (JavaScript cannot read them), SameSite=Strict (they are never sent on cross-site requests), Secure in production, and scoped to our API path only.
3. What We Don't Use
- No third-party advertising or retargeting cookies
- No cross-site tracking or fingerprinting
- No social media pixels
- No analytics of any kind before you opt in, and none at all if you decline
Analytics is the only optional category, and you can turn it on or off at any time in Your Privacy Choices. Turning it off takes effect immediately.
4. Third-Party Services That Set Their Own Cookies
These third parties may set cookies under their own policies:
- Google Analytics, only after you accept analytics. It then sets the
_gacookies listed above (see Google's Privacy Policy). - Stripe, when you open the billing checkout, Stripe may set cookies for payment processing and fraud prevention (see Stripe's Privacy Policy).
- Google / GitHub sign-in, if you authenticate with Google or GitHub, those providers use their own cookies during the OAuth flow.
5. Managing Cookies
You can review your choices anytime on Your Privacy Choices, and you can delete or block cookies through your browser settings. Blocking the strictly-necessary cookies will prevent you from staying signed in. We also honor the Global Privacy Control browser signal as an opt-out of any sale or sharing of personal information (we don't sell or share either way).
6. Contact
Questions about this policy? Email privacy@pulsapi.com or see our full Privacy Policy.