Cookie policy
How Team Brain uses cookies and similar storage technologies on the Service.
Effective date: 27 October 2026
This notice explains how Team Brain (“Team Brain”, “we”, “us”) uses cookies and similar storage technologies on the Team Brain Service (the “Service”) at team-brain.com. It complements our Privacy Policy.
1. What cookies and similar technologies are
A cookie is a small text file that a website asks your browser to store. The browser sends it back to the website every time you visit a page. Similar technologies include localStorage and sessionStorage (key-value stores tied to a domain) and in-memory state (data the website holds only while the tab is open). Team Brain uses all three. Where this notice says “cookies”, it means all of these technologies.
2. Categories we use
Where you are decides which of these start on. If you are in the European Economic Area, the United Kingdom or Switzerland, everything beyond strictly necessary starts off, and a banner asks for your choice before anything else is stored. Everywhere else, the functional, analytics and marketing categories start on, and you can turn any of them off at any time: the “Do not sell or share my personal information” link in the footer turns off the advertising described in 2.4 and 2.5 with one click, and “Cookie settings” turns off the rest. We tell the two apart by the time zone your browser reports. If it reports none, or one we cannot place, we treat you as being in the European Economic Area.
2.1 Strictly necessary
These are required for the Service to work. They sign you in, keep you signed in, protect the Service from abuse, and let real-time collaboration function. Without them, you cannot use Team Brain. Because they are essential we do not ask for your consent before setting them.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| refresh_token | First-party HTTP cookie (HTTP-only, Secure, SameSite=Lax) | Keeps you signed in by issuing new short-lived access tokens. | 7 days |
| tb-auth | sessionStorage | Stores the short-lived access token used for API requests. | Tab session |
| tb-guest | sessionStorage | Allows public share-link viewers to authenticate against an invite-only share. | Tab session |
| collab-token | In-memory only | Authorizes the WebSocket connection used for real-time collaboration. | While tab open |
We also store your cookie consent decision itself as a first-party cookie called tb_consent_v1 (180 days), so that we do not have to ask you on every visit.
2.2 Functional
These cookies remember the choices you have made in the Service so that it behaves the way you want. They are not required for sign-in or collaboration. Whether they start on depends on where you are, as described at the top of this section.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| sidebar-storage | localStorage | Remembers whether the sidebar is open and which of its sections you expanded or collapsed. | Persistent |
| brain:panels | localStorage | Remembers which side panels you left open or closed, such as the mail folders. | Persistent |
| tb-spellcheck | localStorage | Remembers whether you have spellcheck on or off in the editor. | Persistent |
| sensitive-storage | localStorage | Remembers whether you have chosen to mask sensitive fields. | Persistent |
2.3 Analytics
While the analytics toggle is on, our public pages record which marketing channel brought you here, so that we can tell which of our own efforts are worth continuing. Nothing is recorded while it is off, and turning it off erases what was stored.
This runs as Intake, an open-source (MIT) library that we serve from our own domain: no request is made to another company's server. It is separate from the tag manager described in 2.4 and works whether or not that is loaded. It reads the campaign tags on the link you followed, the site you came from, and the advertising click identifier if the link carried one, and it keeps that in first-party cookies named with the intk_ prefix for six months. It does not record what you read, click or type, and identity collection is switched off — your email address and phone number are never read from a form, hashed or otherwise.
If you create an account, the channel that brought you is stored alongside it. If you do not, the record stays in your own browser and never reaches us.
| Name | Type | Purpose | Retention |
|---|---|---|---|
| intk_first, intk_first_add | Cookie | The first channel that brought you here, and the page you landed on. | 6 months |
| intk_current, intk_current_add | Cookie | The most recent channel that brought you here. | 6 months |
| intk_touchpoints | Cookie | The list of channels across your visits, so credit can be shared between them. | 6 months |
| intk_click_ids | Cookie | The advertising click identifier from the link you followed, if it carried one. | 6 months |
| intk_session, intk_udata | Cookie | Distinguishes one visit from the next, so a return is not counted as a new arrival. | Session / 6 months |
2.4 Google Tag Manager and advertising
While both the analytics and the marketing toggle are on, we load Google Tag Manager. It is a container: it holds the measurement and advertising tags we have chosen and loads them in your browser. Today it carries Google Analytics, which counts visits and tells us which pages are read, and it may also carry advertising tags for Google Ads. Nothing is loaded while either toggle is off, and turning either one off removes the container, deletes the cookies listed below and reloads the page, so nothing of it is left running. Once it is on it runs on every page you open, including the pages inside your workspace. A browser that sends a Global Privacy Control signal keeps the marketing toggle off, so the container does not load for it at all.
The recipients are named, not open-ended. Our own security policy lists the exact companies whose scripts may run here — Google and X — so a tag added to the container for anybody else is blocked by your browser until we change our code and ship it. That is why this list and the container can never quietly drift apart. Google and X each act as an independent controller for what they receive.
| Name | Type | Purpose | Retention |
|---|---|---|---|
| _ga, _ga_* | Cookie | Google Analytics. Distinguishes one browser from another so repeat visits are not counted as new people. | 2 years |
| _gid | Cookie | Google Analytics. Groups the pages you open into a single visit. | 24 hours |
| _gcl_au | Cookie | Google Ads. Records that an advertisement was the link you followed, so a signup can be credited to it. | 90 days |
2.5 The advertising pixel for X
While both the analytics and the marketing toggle are on, our public pages also load X's advertising pixel. We load it ourselves rather than through the container in 2.4, under the same two toggles and the same Global Privacy Control rule. It tells X that a visit came from one of our ads on X and, if you go on to create an account, that a signup happened. The signup is identified by the new account's internal number, never by your name or email address. We switch off the pixel's automatic features, so it does not read what you type into forms, the buttons you click, or our other tags, and it reports only the address of the page it started on, without anything after the “?”. It is started only on our public pages and when an account is created, and it reports nothing from inside your workspace. Turning either toggle off removes it, deletes the cookies below and reloads the page. X acts as an independent controller for what it receives.
| Name | Type | Purpose | Retention |
|---|---|---|---|
| _twpid | Cookie | X advertising. Distinguishes one browser from another, so a later signup can be matched to the ad visit. | 13 months |
| _twclid | Cookie | X advertising. The click identifier X adds to the link of an ad you followed. | 13 months |
| _twsid | Cookie | X advertising. Groups the pages you open into a single visit. | 13 months |
| Cookies set by x.com | Third-party cookie | X advertising. Set on X's own domain, not ours, and governed by X's privacy policy. | Set by X |
3. Third-party services you choose to connect
When you choose to connect an integration such as Gmail, Google Drive, or Google Calendar, the corresponding Google service may set its own cookies on its own domain as part of the OAuth sign-in flow. Those cookies are governed by the third party's own cookie policy.
4. Changing your cookie preferences
You can change your cookie preferences at any time with the “Cookie settings” link in the footer of our public pages and of the sign-in page. Outside the European Economic Area, the United Kingdom and Switzerland, the “Do not sell or share my personal information” link beside it turns off the advertising in 2.4 and 2.5 in one click and keeps everything else as it is. Your preferences are stored in the tb_consent_v1 cookie for 180 days. You can also clear cookies for the Service in your browser settings; if you do, the starting point described in section 2 applies again on your next visit.
5. Do Not Track and Global Privacy Control
A browser that sends a Global Privacy Control signal is treated as having opted out of the sale and sharing of personal information: the marketing toggle stays off for it wherever you are, so neither the container in 2.4 nor the pixel in 2.5 ever loads, and the switch cannot be turned on while the signal is sent. Do Not Track stops the product measurement described in our Privacy Policy. In the European Economic Area, the United Kingdom and Switzerland every toggle starts off anyway, so on a first visit there these signals describe what already happens.
6. Changes to this notice
We may update this notice from time to time. When we make a material change we will revise the “Effective date” at the top and, where appropriate, ask for your consent again through the cookie banner.
7. Contact
If you have any question about this notice please contact us through the Service.