Cookie Policy
Last updated · Circo, Inc.
In plain English
- Capable uses only cookies it needs to work: keeping you signed in, remembering that you passed two-factor, and remembering whether the sidebar is open.
- We do not use advertising cookies or cross-site tracking.
- Because every cookie is strictly necessary, we do not show a cookie banner.
This summary helps you read the document. The numbered sections below are what bind.
Contents
1. What cookies are
Cookies are small text files a website stores in your browser. This policy explains the cookies set on capable.so by Circo, Inc., which operates Capable. It supplements our Privacy Policy.
2. Cookies we set
| Cookie | Purpose | Duration | Type |
|---|---|---|---|
| better-auth.session_token | Keeps you signed in and ties requests to your session. In production the name carries the __Secure- prefix. | Up to 7 days, renewed while you use the app | Strictly necessary, first party |
| capable_2fa | Proves this browser session passed a two-factor check, so we do not ask again on every page. | 30 days | Strictly necessary, first party |
| Sign-in state cookies (names start with better-auth.) | Protect Google and single sign-on flows against forgery while you are redirected to your identity provider. | Minutes, deleted when sign-in finishes | Strictly necessary, first party |
| sidebar_state | Remembers whether you collapsed the app sidebar. | 7 days | Functional, first party |
Session and two-factor cookies are HTTP-only, sent only over HTTPS in production, and restricted to our own site. The sidebar cookie stores a single true or false value and nothing about you.
3. Third-party cookies
We do not place advertising, analytics, or social media cookies on capable.so.
Some steps take you to another company’s site, which sets its own cookies under its own policy. For example, Stripe sets cookies on its checkout and billing pages to process payments and prevent fraud, and Google sets cookies when you sign in with Google.
4. Why there is no cookie banner
Privacy laws such as the EU ePrivacy Directive and UK PECR do not require consent for cookies that are strictly necessary to provide a service you ask for. Every cookie we set falls in that group or stores a preference you chose. If we add any cookie that needs consent, we will ask for it before setting the cookie and will update this page.
5. Your choices
You can block or delete cookies in your browser settings. If you block the session or two-factor cookies, you will not be able to sign in to Capable. The public marketing pages work without cookies. We treat Global Privacy Control signals as an opt-out of any sale or sharing of personal data, which we do not do.
6. Changes and contact
We update this page when our cookies change and revise the date at the top. Questions: privacy@capable.so.