Cookie and storage notice
Cookies
No advertising or analytics tracker is built into this site.
Xpancom does not set analytics, advertising, or preference cookies on the public marketing site. Signed-in surfaces set strictly necessary session cookies. There is no cookie banner because there is no optional tracking to consent to.
01 / Section
The public marketing site.
Navigation menus, the workflow example, expandable questions, and the inquiry form use temporary page state. Inquiry details are not written to a cookie or to local storage. Submitting an inquiry sends the details to Xpancom; it does not store them in your browser after you leave. An unlisted concept-preview link does not set a cookie. Asking for the full video is an inquiry.
02 / Section
Cookies we actually use.
Session cookies appear only after an invited person signs in on auth.xpancom.com or app.xpancom.com. They are first-party, strictly necessary, and not used for advertising. When cross-subdomain cookies are enabled, the domain is xpancom.com.
| Name | Who sets it | Purpose | Duration | Type |
|---|---|---|---|---|
| better-auth.session_token | Xpancom (auth.xpancom.com / app.xpancom.com) | Invitation-only signed-in session. HttpOnly. Not set on the public marketing browse. | Until the session expires or the person signs out | Strictly necessary |
| better-auth.session_data | Xpancom (auth.xpancom.com / app.xpancom.com) | Session cache for the signed-in workspace. HttpOnly. | Until the session expires or the person signs out | Strictly necessary |
| Host cookie domain | Xpancom when BETTER_AUTH_COOKIE_DOMAIN is xpancom.com | Allows the session to work across auth.xpancom.com and app.xpancom.com. Never used for advertising. | Same as the session cookies | Strictly necessary |
| Hosting protection cookies | Vercel | Deliver and protect the site (deployment routing, optional deployment protection). | Set by the host for the request or the protection session | Strictly necessary (host) |
03 / Section
Hosting and future changes.
The hosting provider may use its own strictly necessary mechanisms to deliver and protect the site. Those are outside Xpancom application code.
Adding analytics, advertising, embedded third-party services, or any consent-dependent feature requires reviewing the actual providers and updating this notice, the Privacy Policy, and the site's controls first. That is a privacy change, not a footer edit.