Draft pending counsel spot-check. Template content; pending legal review of jurisdictional specifics.
1. What cookies are
Cookies are small text files stored on your device by your browser. They allow websites to remember information between visits. Similar technologies include local storage, session storage, and web beacons; this policy uses “cookies” as shorthand for all of these.
2. Cookie categories
Brand Atlas uses four cookie categories:
Strictly necessary
Required for the Service to function: authentication, session management, security. These cookies are set without consent because the Service cannot operate without them. They are first-party.
Functional
Improve the user experience but are not strictly necessary: language preference, theme (light/dark), sidebar state. These are set on first interaction and can be cleared by signing out.
Analytics
Privacy-respecting analytics (PostHog or Plausible) to understand aggregate usage. We do not use third-party advertising trackers. Analytics cookies require consent in jurisdictions that mandate it.
Marketing
We do not use marketing or advertising cookies on the Service. The marketing site at brandatlas.pro may use analytics; it does not use ad-tracking cookies.
3. Consent
In the EU/EEA, UK, and other jurisdictions requiring granular consent before non-essential cookies fire, the Service displays a cookie consent banner on first visit. You can:
- Accept all categories.
- Accept only strictly necessary.
- Customise per category.
Your choice is remembered for 12 months or until you clear it. You can change your choice at any time from Settings → Privacy → Cookie preferences.
4. Cookie inventory
The current cookie inventory is maintained in Settings → Privacy → Cookie inventory and is updated when cookies are added or removed. Representative cookies:
| Cookie | Category | Purpose | Duration |
|---|
ba_session | Strictly necessary | Authentication session | Session |
ba_csrf | Strictly necessary | CSRF protection | Session |
ba_theme | Functional | Light/dark theme preference | 1 year |
ba_lang | Functional | Interface language | 1 year |
ph_* | Analytics | PostHog usage analytics | 1 year |
5. Third-party cookies
Stripe sets cookies when you reach the billing flow. These are governed by Stripe’s Privacy Policy.
When a Guest Pass accesses an embed (Figma, YouTube, Vimeo, etc.), the embed provider may set their own cookies. These are governed by the embed provider’s policy.
6. Do Not Track
We respect Do Not Track (DNT) signals: when DNT is set in your browser, the Service does not load analytics cookies even if you would otherwise have consented.
7. Changes
We may update this Policy. Material changes are announced 30 days in advance.
For cookie questions, contact legal@brandatlas.pro.
What changed
- 27 May 2026: Initial draft published.
