Cookie Policy
Last updated: July 3, 2026
1. What Are Cookies and Browser Storage?
Cookies are small text files that are placed on your device when you visit our website. They help us provide you with a better experience by remembering your preferences and maintaining your session.
In addition to traditional cookies, modern browsers provide other storage mechanisms such as localStorage and sessionStorage. These are not cookies - they do not get sent to the server with every request - but they allow websites to store small amounts of data in your browser for UI preferences and navigation state. We describe all storage mechanisms we use in this policy for full transparency.
2. Cookie Consent
Essential cookies are required for the Service to function and are set automatically. In addition, on our public marketing pages (surfacedby.com) we use analytics and advertising-measurement cookies from Google Analytics, the Meta (Facebook) Pixel, and Microsoft Clarity to understand how visitors use the site and to measure the performance of our advertising. These are described in section 3.3 below.
In regions where prior consent is required, a cookie banner asks you to accept or reject non-essential cookies before any analytics or advertising cookie is set, and lets you choose the Analytics and Advertising categories separately. Your choice is remembered, and you can change it anytime from the "Cookie preferences" link in the site footer. Elsewhere, analytics and advertising cookies are set by default and you can opt out at any time.
You can also block analytics and advertising cookies through your browser settings or the provider opt-outs listed in section 4 without affecting your ability to use the Service.
3. How We Use Cookies and Browser Storage
3.1 Essential Cookies
These cookies are strictly necessary for the website to function. They enable authentication, session management, and security. They cannot be disabled.
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
| sb-*-auth-token | Supabase Auth | Authentication JWT tokens. Stores your access token and refresh token to keep you signed in. May be split into chunked variants (.0, .1, etc.) for large tokens. | Access token: 1 hour; Refresh token: up to 7 days |
| cf_clearance / cf_turnstile_* | Cloudflare | Bot protection via Cloudflare Turnstile on free audit, content checker, robots checker, and llms.txt generator forms. Stores challenge state data to verify you are a real user. | Session |
| sb_consent | SurfacedBy | Records your cookie-consent choice (whether you allowed the Analytics and Advertising categories) so we apply it and do not ask again. Strictly necessary to honor your preference; it is set only after you make a choice. | 180 days |
3.2 Error Monitoring Cookies
We use Sentry for error tracking and debugging to ensure the Service runs reliably. Sentry records masked session replays to help us diagnose issues - all text in replays is masked and no keystrokes are captured. Sentry retains error and replay data for 90 days.
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
| sentry-* | Sentry | Error tracking, performance monitoring, and masked session replays for debugging. No personal keystrokes or unmasked text is captured. | Session |
3.3 Analytics and Advertising Cookies
On surfacedby.com we load Google Analytics, the Meta (Facebook) Pixel, and Microsoft Clarity through Google Tag Manager (Google Tag Manager itself sets no cookies). We use them to understand how visitors find and use the site, to measure the performance of our advertising, and to improve usability. Microsoft Clarity records session replays and heatmaps with text inputs masked by default. The Meta Pixel works together with Meta's Conversions API: when you take certain actions (such as signing up or subscribing) we share a hashed, irreversible version of your email address, a pseudonymous customer identifier, and your IP address and browser user agent with Meta to match the action to an ad. We never share your raw email or other plain-text personal data.
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
| _ga, _ga_* | Google Analytics | Distinguishes visitors and sessions to measure how the site is used. | Up to 2 years |
| _fbp, _fbc | Meta (Facebook) | Meta Pixel advertising and conversion measurement. _fbc stores an ad-click identifier and is only set when you arrive from a Meta ad. | Up to 3 months |
| _clck, _clsk, MUID, CLID, ANONCHK | Microsoft Clarity | Session replay and heatmaps for usability analysis. Persists a pseudonymous Clarity user/session id and Microsoft analytics identifiers. | Session to 1 year |
| sb_attr | SurfacedBy | First-party audience-measurement cookie that records when you arrive at surfacedby.com from an AI assistant (such as ChatGPT, Perplexity, or Gemini) so we can measure our own visibility in AI search. It stores a random identifier only; we do not store your IP address, use it for advertising, or share it with third parties or across other websites. | Up to 13 months |
| sb_affonso_ref | Affonso (affiliate program) | Affiliate referral attribution. Records which affiliate referred you so a resulting subscription can be credited to them. Only set when you arrive via an affiliate link; Affonso may set its own attribution cookie for the same purpose. | Up to 90 days |
3.4 Payment Cookies (Loaded On-Demand)
Payment-related cookies are only present when you initiate a checkout, not during normal browsing. Checkout on surfacedby.com is handled by our payment provider, Polar, in an embedded checkout window. SurfacedBy does not set any first-party cookie during checkout; Polar may set its own cookies within its checkout (on polar.sh), governed by Polar's privacy policy.
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
| Polar checkout cookies | Polar | Set by Polar's embedded checkout (on polar.sh) when you start a purchase, to process the payment and complete your order. These are third-party to surfacedby.com and controlled by Polar. | Session |
3.5 Functional Browser Storage (localStorage)
We do not store dashboard UI preferences (such as collapsed sections, dismissed banners, or in-progress report drafts) in localStorage. These are stored against your account on our servers so they travel with you across devices, and are covered by our Privacy Policy rather than this Cookie Policy.
3.6 Functional Browser Storage (sessionStorage)
The following items are stored in your browser's sessionStorage. These are automatically cleared when you close the browser tab and are never sent to our servers.
| Key | Purpose | Duration |
|---|---|---|
| lastDomainId | Remembers the last domain you visited for navigation continuity. | Cleared when browser tab closes |
| preferred_plan | Carries your selected plan through the signup flow so you don't have to re-select it. | Cleared when browser tab closes |
| sb_signup_conversion_resolved | Marks that your sign-in was already checked for analytics this session, so we do not repeat the check on every page load. | Cleared when browser tab closes |
4. Managing Cookies and Browser Storage
You have the right to manage cookies and browser storage. Most web browsers automatically accept cookies, but you can modify your browser settings to decline cookies if you prefer. Note that blocking essential cookies will prevent you from using the Service.
4.1 Managing Cookies via Browser Settings
You can manage cookies through your browser settings:
- Chrome: Settings > Privacy and security > Cookies
- Firefox: Options > Privacy & Security > Cookies
- Safari: Preferences > Privacy > Cookies
- Edge: Settings > Cookies and site permissions
4.2 Clearing sessionStorage
To clear sessionStorage data, open your browser's developer tools (typically F12 or right-click > Inspect), navigate to the Application tab (Chrome/Edge) or Storage tab (Firefox), then expand Session Storage for our domain. You can delete individual items or clear all stored data from there.
Clearing sessionStorage (or closing the browser tab) will reset your navigation state. Dashboard UI preferences (collapsed sections, dismissed banners, in-progress report drafts) are stored against your account on our servers, not in browser storage; sign out and sign back in if you wish to refresh them.
4.3 Opting Out of Analytics and Advertising
In addition to your browser settings, you can opt out of the specific analytics and advertising services we use:
- Google Analytics: install the Google Analytics Opt-out Browser Add-on.
- Meta (Facebook): manage ad preferences in your Meta ad settings.
- Microsoft Clarity: opt out via the Microsoft opt-out page.
5. Impact of Blocking Cookies
If you choose to block or delete cookies, some features of our Service may not work properly. Essential cookies (authentication and security) cannot be disabled as they are necessary for the website to function. Blocking functional browser storage will not prevent you from using the Service, but your UI preferences will not be remembered between visits.
6. Updates to This Policy
We may update this Cookie Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of any significant changes by posting the new policy on this page with a revised "Last updated" date.
7. Privacy Policy
For more information about how we handle your data, please see our Privacy Policy at surfacedby.com/privacy.
8. Contact Us
If you have questions about our use of cookies or browser storage, please contact us:
- Email: [email protected]