Table of contents
DRAFT FOR COUNSEL REVIEW. Section 3 is filled in from a real browser audit of both surfaces carried out 2026-09-20, signed out. The signed-in platform and the sign-up flow still need the same pass before publication; section 3 says so explicitly and must not be published while that note is there.
1. What cookies are
A cookie is a small file a website stores in your browser. Similar technologies include local storage, session storage and browser databases, which also keep data on your device. This policy covers all of them.
2. How Corvant uses them
We use them for four purposes:
Strictly necessary. Keeping you signed in, maintaining your session, remembering which account you are working in, and protecting against cross-site request forgery. The platform does not work without these, and we do not ask consent for them.
Preference. Remembering choices such as light or dark theme.
Intake. During sign-up, the platform holds the answers you have given before you create an account so that the flow survives a page refresh. Uploaded entry files may be held temporarily in your own browser's storage until your account exists, at which point they are transferred to your account and removed from the browser. This data is on your device, not ours, until you sign in.
Analytics. Understanding how the product is used so we can improve it: which screens are opened, where errors occur, and where people get stuck. We use this at the level of an account and a session, not to build a profile of you across other websites.
We do not use advertising cookies and we do not sell data collected through cookies.
3. The cookies and storage we set
The public website, corvant.io
Audited 2026-09-20. The public website sets no cookies at all, uses no local or session storage, and loads no third-party scripts. Fonts are served from our own domain, so browsing corvant.io sends nothing to anyone else.
The platform, before you sign in
Audited 2026-09-20 on the sign-in page. No cookies readable by page scripts, no local or session storage, and no analytics or advertising scripts.
One third party is contacted: Google Fonts, which serves the typefaces the platform uses. Your browser requests the font files from Google, which means Google receives your IP address and basic request information. Google does not set a cookie for this. [FOR COUNSEL AND ENGINEERING: the public website self-hosts its fonts and the platform does not. Self-hosting the platform's fonts would remove this third party entirely and is the simpler fix.]
Signing in, and using the platform
When you sign in we set a session cookie. It is marked httpOnly, which means page scripts cannot read it, and it exists to keep you signed in and to identify which account you are working in. It is strictly necessary; the platform does not work without it.
During sign-up the platform sets a short-lived intake cookie holding the answers you have given before your account exists, and may hold an uploaded entry file in your browser's own storage until your account is created, at which point the file is transferred to your account and removed from the browser.
The platform includes a product analytics component and an error monitoring component. Where these are active they record usage events and error reports tied to your account, and the analytics component may store an identifier in your browser. Error monitoring runs on infrastructure we operate ourselves; product analytics is provided by PostHog and is hosted in the United States.
Payment pages and electronic signature pages are operated by our providers and may set their own cookies under their own policies.
[REMAINING AUDIT, OWED BEFORE PUBLICATION: a signed-in session and a completed sign-up flow must be inspected and each cookie, storage key and third-party request named here with its purpose and lifetime, in the same way as the two sections above. The paragraphs immediately above are written from the platform's source code, not from an observed session, and are deliberately general until that pass is done.]
4. Third-party cookies
Some pages include services operated by others, which may set their own cookies under their own policies. This applies in particular to payment and electronic signature pages. Where that is the case it will be listed in section 3 with a link to that provider's policy.
5. Controlling cookies
Your browser lets you see, block and delete cookies and clear site data. Every major browser publishes instructions for this.
Blocking strictly necessary cookies will stop you from signing in or using the platform. Blocking or clearing storage during sign-up may mean you are asked to upload your file again after you sign in; nothing is lost.
Where we offer an analytics opt-out in the platform, it will be in your account settings.
6. Do Not Track
There is no common standard for how sites should respond to a browser Do Not Track signal, and we do not currently respond to it. We do not track you across other websites in any event.
7. Changes
We may update this policy. The date above will change, and material changes will be notified through the platform or by email.
8. Contact
Write to legal@corvant.io.