Start freeBook a Demo
Trust & compliance

Cookie Policy

Every cookie Spinrun sets, which of them you choose, and what happens to the rest.

Last updated v2026-10-04

Spinrun sets ten cookies of its own. Every one of them is necessary for something you asked the site to do — stay signed in (two cookies), finish an email sign-up in the browser you started it in, stay in the language you chose, stay in the workspace you opened, complete a sign-in without being hijacked halfway through, carry the first task you typed on the home page into your new account, and remember the answer you gave about the eleventh.

The eleventh is analytics, and it is yours to decide. It does not load when you arrive. It loads if you say yes, it never loads if you say no, and you can change that answer from the footer of any page without having to find this one again.

Contents

  1. 1.The choice you are given

    Consent is required for cookies that are not strictly necessary, and it has to be given before anything is set rather than assumed afterwards. So the first time you visit, nothing optional has loaded: no request has been made to an analytics provider, and no cookie of theirs exists in your browser.

    Accepting and refusing are the same size, in the same place, and one click each. Scrolling past the banner is not an answer, closing it is not an answer, and there is no version of this site that you have to accept anything to read.

    We remember your answer for six months and then ask again. Changing it in the meantime takes the same one click: "Cookie settings", at the bottom of every page.

  2. 2.The cookies we set

    These are ours, they are necessary, and they are not part of the choice above — without them the things you asked the site to do would not work.

    __Host-spinrun-session
    Your signed-in session. Lasts 14 days and is renewed while you use the product. HttpOnly and host-only: set for spinrun.ai alone, never readable by a subdomain or by scripts. Cleared when you sign out.
    __Host-spinrun-session-data
    A signed copy of your session, so the application does not look it up on every request. Five minutes, renewed as you browse. Cleared when you sign out.
    __Host-spinrun-pending
    Set when you sign up with an email address, so the code we email can be entered in the same browser. It holds a random value, not your address. One hour; asking for a new code renews it for up to another hour, but never past three hours from when you signed up. Deleted sooner when you confirm, start over, or enter a wrong code too many times.
    spinrun_locale
    Remembers whether you asked for English or Romanian, so the choice survives a visit. One year.
    spinrun_ws
    Remembers which workspace this browser is currently working in. One year. HttpOnly and host-only: set for spinrun.ai alone, never sent to a subdomain or readable by scripts. It is a selector, never an authorisation — what you can actually reach is checked against your real memberships on every request.
    spinrun_google_state
    Protects the Google sign-in flow against cross-site request forgery. Ten minutes, then deleted.
    spinrun_google_verifier
    The PKCE verifier that ties the end of a Google sign-in to the browser that started it. Ten minutes, then deleted.
    spinrun_consent
    The answer you gave about analytics, and when you gave it. This one is necessary because the alternative to remembering your answer is asking again on every page. Six months.
    spinrun_first_task
    Keeps the task you typed on the home page for an hour so onboarding can open chat with it. Written only when you press Start free; read once when you finish onboarding and deleted then. Pressing Start free with an empty box deletes it instead. One hour at most.
    sidebar_state
    Whether you left the dashboard sidebar open or collapsed. A layout preference and nothing else. Seven days.

  3. 3.Analytics, only if you allow it

    If you accept analytics, we load PostHog on the marketing pages. It records which pages are opened and what is clicked, and it records session replays — a reconstruction of the page as you saw it — with every input field masked, so what you type is never captured. It is not loaded inside the product; the dashboard runs no analytics script at all.

    PostHog is hosted in the European Union and receives no data from us before you say yes.

    ph_…_posthog
    PostHog's own cookie: an anonymous identifier that lets it tell one visit from two. The name varies with the project. One year, or until you withdraw consent, whichever comes first.
    Subprocessors

  4. 4.How they are set

    • Every cookie we set is SameSite=Lax, so none is sent along with a cross-site request, and every one is marked Secure over HTTPS, so none travels in the clear.
    • All of them are HTTP-only — no script on the page can read one — except two, which are written by the browser. `sidebar_state` is written where the sidebar it describes is drawn, and holds one word: whether a panel is open. `spinrun_first_task` is written by the home page's prompt box when you press Start free, and holds only the task you typed there.
    • The PostHog cookie is set by PostHog, in your browser, and follows its own rules rather than ours. It exists only after you have accepted, and expiring it is part of what withdrawing does.

  5. 5.What we still do not set

    No advertising or retargeting pixel. No cross-site tracker. Nothing that follows you off this site, and nothing that builds a profile of you to sell.

    Content your agents author is served from routes deliberately kept outside the middleware that sets cookies, so no cookie of ours is ever attached to it, and no analytics script runs there either. That is a security property first — it means agent-authored HTML cannot borrow your session — and a privacy one second.

    Separately from anything in your browser: inside the product we record a small number of events on our own servers — a workspace created, a connection added, a run finished — against your account identifier, to know which parts of Spinrun are used. Nothing is stored on your device for it, no cookie is involved, and it never includes what your agents read or wrote. The Privacy Policy explains the basis for it and how to object.

    Privacy Policy

  6. 6.Turning them off

    Analytics: "Cookie settings" at the bottom of any page. Switching it off stores the refusal, expires PostHog's cookie and reloads the page without it. Withdrawing is meant to cost exactly what agreeing cost, and nothing you did while it was on is held against the choice.

    The rest: your browser can block or delete any cookie. Blocking the session cookie will stop you signing in; blocking the others degrades the site rather than breaking it — you will land in English, you will have to pick your workspace again, an email sign-up will ask for your password again when you open the link (the code box cannot confirm in that browser), and a new account will open chat without the task you typed on the home page.

  7. 7.Contact

    Questions about cookies go to legal@spinrun.ai.

Before anything loads

We would like to switch on analytics, so we can see which pages are worth keeping. Nothing has loaded yet and nothing will until you choose. The cookies that keep you signed in and remember your language are not part of this.

Read the Cookie Policy