Cookie policy

Last updated 2026-10-15

This policy lists every cookie and every item of browser storage Refract sets, what each is for and how long it lasts. Refract is run by Anpsthemes LLC (postal address: Anpsthemes LLC · 30 N Gould St Ste N, 82801, Sheridan, United States).

The short version

Refract sets only the cookies it needs to work, plus one that remembers your light or dark theme.
No analytics, advertising or tracking cookies, and no tracking pixels. Nothing here follows you to other sites.
Stripe sets its own cookies on its own pages when you pay. Some mail apps load fonts from Google when you open our emails.
Because every cookie is needed for the service or set by your own choice, we don't show a cookie banner.

1. Cookies Refract sets

These are first-party cookies on refract.social (and on an agency's own domain when you use Refract there).

Name	What it's for	How long	Type
`refract-session`	Keeps you signed in as you move between pages, and holds short-lived data such as form errors. Can't be read by scripts.	2 hours after your last activity	Strictly necessary
`XSRF-TOKEN`	Protects your account from forged requests (cross-site request forgery).	2 hours	Strictly necessary
`remember_web_…`	Keeps you signed in on this browser after the session ends, until you sign out. Can't be read by scripts.	Up to 400 days, or until you sign out	Strictly necessary
`refract_connect`	Links your browser to a social account connection you started, so nobody else can finish it. Sent only to the connection pages.	15 minutes	Strictly necessary
`refract_integration`	The same, for connecting Google Drive, Dropbox, Slack or Bitly.	15 minutes	Strictly necessary
`socialite_apple_nonce`	Protects Sign in with Apple while Apple sends you back to Refract. Set only when you use it.	10 minutes	Strictly necessary
`refract_theme`	Remembers whether you chose light, dark or system theme, so pages open in the right colours.	1 year	Preference

2. Browser storage

Key	What it's for	How long	Type
`refract.sidebar.collapsed` (local storage)	Remembers whether you collapsed the sidebar in the app.	Until you clear your browser's storage	Preference

Refract doesn't use session storage, and doesn't put anything else in your browser's storage.

3. What Refract doesn't use

No analytics or statistics tools (such as Google Analytics).
No advertising, retargeting or social media pixels.
No fingerprinting.

Refract's short links (used in posts) count clicks without setting cookies.

4. Other services

Stripe and Link. When you buy a plan or credits, you go to Stripe Checkout, and "Manage billing" opens Stripe's customer portal. Those pages are on Stripe's own domains, and Stripe sets its own cookies there for payments and fraud prevention. See Stripe's privacy policy, which covers its cookies.
Signing in with Google or Apple, and connecting networks. You go to their sites, which set their own cookies under their own policies.
Our emails. Our emails ask for fonts from Google Fonts. Mail apps that load them connect to Google, which sees your IP address. Many mail apps load them through a proxy or block them; you can turn off remote content in your mail app. Our emails have no tracking pixels and their links aren't tracked.

5. Controlling cookies

Your browser lets you see, block and delete cookies, usually in its privacy or site settings. If you block the strictly necessary cookies, you won't be able to sign in. If you delete refract_theme or the sidebar setting, Refract simply goes back to the default.

6. Changes

If we add a cookie or storage item, we update this page and the date at the top first. We'll never add analytics or advertising cookies without asking you first.

7. Contact

Questions about cookies: privacy@refract.social.

Questions about this page: privacy@refract.social