Cookie policy
How Team Brain uses cookies and similar storage technologies on the Service.
Effective date: 27 August 2026
This notice explains how Team Brain (“Team Brain”, “we”, “us”) uses cookies and similar storage technologies on the Team Brain Service (the “Service”) at team-brain.com. It complements our Privacy Policy.
1. What cookies and similar technologies are
A cookie is a small text file that a website asks your browser to store. The browser sends it back to the website every time you visit a page. Similar technologies include localStorage and sessionStorage (key-value stores tied to a domain) and in-memory state (data the website holds only while the tab is open). Team Brain uses all three. Where this notice says “cookies”, it means all of these technologies.
2. Categories we use
2.1 Strictly necessary
These are required for the Service to work. They sign you in, keep you signed in, protect the Service from abuse, and let real-time collaboration function. Without them, you cannot use Team Brain. Because they are essential we do not ask for your consent before setting them.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| refresh_token | First-party HTTP cookie (HTTP-only, Secure, SameSite=Lax) | Keeps you signed in by issuing new short-lived access tokens. | 7 days |
| tb-auth | sessionStorage | Stores the short-lived access token used for API requests. | Tab session |
| tb-guest | sessionStorage | Allows public share-link viewers to authenticate against an invite-only share. | Tab session |
| collab-token | In-memory only | Authorizes the WebSocket connection used for real-time collaboration. | While tab open |
We also store your cookie consent decision itself as a first-party cookie called tb_consent_v1 (180 days), so that we do not have to ask you on every visit.
2.2 Functional
These cookies remember the choices you have made in the Service so that it behaves the way you want. They are not required for sign-in or collaboration. We only set them with your permission.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| sidebar-storage | localStorage | Remembers which sections of the sidebar you expanded or collapsed. | Persistent |
| tb-spellcheck | localStorage | Remembers whether you have spellcheck on or off in the editor. | Persistent |
| sensitive-storage | localStorage | Remembers whether you have chosen to mask sensitive fields. | Persistent |
2.3 Analytics
When — and only when — you turn the analytics toggle on, our public pages record which marketing channel brought you here, so that we can tell which of our own efforts are worth continuing. Nothing is recorded until you agree, and turning the toggle back off erases what was stored.
This runs as Intake, an open-source (MIT) library that we serve from our own domain: no request is made to another company's server. It is separate from the tag manager described in 2.4 and works whether or not that is loaded. It reads the campaign tags on the link you followed, the site you came from, and the advertising click identifier if the link carried one, and it keeps that in first-party cookies named with the intk_ prefix for six months. It does not record what you read, click or type, and identity collection is switched off — your email address and phone number are never read from a form, hashed or otherwise.
If you create an account, the channel that brought you is stored alongside it. If you do not, the record stays in your own browser and never reaches us.
| Name | Type | Purpose | Retention |
|---|---|---|---|
| intk_first, intk_first_add | Cookie | The first channel that brought you here, and the page you landed on. | 6 months |
| intk_current, intk_current_add | Cookie | The most recent channel that brought you here. | 6 months |
| intk_touchpoints | Cookie | The list of channels across your visits, so credit can be shared between them. | 6 months |
| intk_click_ids | Cookie | The advertising click identifier from the link you followed, if it carried one. | 6 months |
| intk_session, intk_udata | Cookie | Distinguishes one visit from the next, so a return is not counted as a new arrival. | Session / 6 months |
2.4 Google Tag Manager and advertising
When — and only when — you turn both the analytics and the marketing toggle on, we load Google Tag Manager. It is a container: it holds the measurement and advertising tags we have chosen and loads them in your browser. Today it carries Google Analytics, which counts visits and tells us which pages are read, and it may also carry advertising tags for Google Ads and for X. Nothing is loaded until both toggles are on, and turning either one back off removes the container, deletes the cookies listed below and reloads the page, so nothing of it is left running. Once it is on it runs on every page you open, including the pages inside your workspace.
The recipients are named, not open-ended. Our own security policy lists the exact companies whose scripts may run here — Google and X — so a tag added to the container for anybody else is blocked by your browser until we change our code and ship it. That is why this list and the container can never quietly drift apart. Google and X each act as an independent controller for what they receive.
| Name | Type | Purpose | Retention |
|---|---|---|---|
| _ga, _ga_* | Cookie | Google Analytics. Distinguishes one browser from another so repeat visits are not counted as new people. | 2 years |
| _gid | Cookie | Google Analytics. Groups the pages you open into a single visit. | 24 hours |
| _gcl_au | Cookie | Google Ads. Records that an advertisement was the link you followed, so a signup can be credited to it. | 90 days |
| Cookies set by x.com | Third-party cookie | X advertising. Set on X's own domain, not ours, and governed by X's privacy policy. Only reached if an X advertising tag is running. | Set by X |
3. Third-party services you choose to connect
When you choose to connect an integration such as Gmail, Google Drive, or Google Calendar, the corresponding Google service may set its own cookies on its own domain as part of the OAuth sign-in flow. Those cookies are governed by the third party's own cookie policy.
4. Changing your cookie preferences
You can change your cookie preferences at any time by clicking the “Cookie settings” link in the footer of the sign-in page. Your preferences are stored in the tb_consent_v1 cookie for 180 days. You can also clear cookies for the Service in your browser settings; if you do, we will ask you again the next time you visit.
5. Do Not Track and Global Privacy Control
Some browsers can send a Do Not Track header or a Global Privacy Control signal. Every measurement described in 2.3 and 2.4 is off until you switch it on, and both toggles start off — so on a first visit these signals describe what already happens. If you have switched a toggle on, that choice is the one we act on; you can turn it back off at any time as described in section 4.
6. Changes to this notice
We may update this notice from time to time. When we make a material change we will revise the “Effective date” at the top and, where appropriate, ask for your consent again through the cookie banner.
7. Contact
If you have any question about this notice please contact us through the Service.