Cookie policy

At a glance

What cookies do we use? We use a minimal set of first-party cookies, alongside local browser storage (localStorage, sessionStorage, and IndexedDB) to make our platform work.
Why do we use them? We use these technologies to remember your consent preferences, keep your dashboard sign-in secure, save your theme choices, and understand how developers use our websites and dashboard.
What types do we use? We use strictly necessary, functional, and analytics technologies. We do not use any marketing, advertising, or cross-site tracking cookies.
How can you control them? Depending on your location, you will see a consent banner allowing you to accept or reject analytics on our marketing and documentation sites. You can also opt out at any time, use your browser settings, or send a Global Privacy Control (GPC) signal.
Do third parties use cookies on our site? We use Google Analytics 4, PostHog, and Cloudflare for analytics and monitoring. Featurebase operates our feedback and help portals under its own policy.

1. What are cookies and similar technologies
2. How we use cookies
3. Third-party cookies and services
4. Do Not Track and Global Privacy Control
5. Your cookie choices
6. Cookie duration and data retention
7. International data transfers
8. Changes to this cookie policy
9. Contact us

1. What are cookies and similar technologies

Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work, improve user experience, and provide information to site owners.

Because Tovio, LLC operates a modern software platform, we rely heavily on "similar technologies" built directly into your web browser rather than traditional cookies. These include:

localStorage: Allows us to save data in your browser that persists even after you close the window. We use this for non-sensitive preferences like your UI theme or tutorial progress, and for the anonymous PostHog identifier described below.
sessionStorage: Similar to localStorage, but the data is automatically erased when you close your browser tab. We use this to manage your active sign-in on our dashboard.
IndexedDB: A browser database that we use to store non-exportable device keys for dashboard authentication.

When we refer to "cookies" in this policy, we are referring to both traditional cookies and these browser storage technologies. Our hosted service does not use cookies for sign-in.

2. How we use cookies

We categorize the cookies and storage technologies we use into the following groups.

2.1 Strictly necessary (always on)

These technologies are essential for our websites and dashboard to function securely and correctly. They remember your privacy choice and keep your dashboard sign-in secure. Because our services cannot function without them, they cannot be disabled.

Name	Provider	Purpose	Duration
`tovio_consent` (cookie)	Tovio	Records whether you granted, denied, or implied consent	180 days
Sign-in session token	Tovio	Keeps you signed in to the dashboard (sessionStorage)	Until the tab closes
Sign-in state	Tovio	Protects the sign-in flow on the dashboard (sessionStorage)	Until the tab closes
Device keys	Tovio	Secures dashboard access with non-exportable keys (IndexedDB)	Until cleared

2.2 Functional (always on)

Functional storage remembers choices you make or progress you have saved. It is set whether or not you accept analytics, and is not shared with third parties — with one exception noted in its row below: if you accept analytics, the homepage version you were shown is reported alongside the events in section 2.3, because knowing which message was on screen is the entire purpose of measuring them.

Name	Provider	Purpose	Duration
`tovio_hero_variant`	Tovio	Remembers which of three homepage messages you were shown, so the page does not change under you between visits (localStorage). Set on your first visit, before any analytics choice. Reported with analytics events only if you accept them.	Until cleared
`tovio-tutorial-step`	Tovio	Remembers your tutorial progress on tovio.dev (localStorage)	Until cleared
Theme preference	Tovio	Remembers your light or dark theme on docs.tovio.dev and the dashboard (localStorage)	Until cleared
Selected Forge address	Tovio	Remembers which Forge the dashboard connects to (localStorage)	Until cleared
Organization	Tovio	Remembers your active organization on the dashboard (localStorage)	Until cleared

2.3 Analytics and monitoring

We use analytics and monitoring tools to understand how visitors use our websites and dashboard and to find errors. We deny advertising storage and ad personalization within our analytics tools.

On our marketing and documentation sites (tovio.dev and docs.tovio.dev): if you visit from the European Economic Area, the United Kingdom, Switzerland, Guernsey, Jersey, or the Isle of Man (or we cannot determine your location), these tools load only if you click "Accept". Everywhere else, they load by default and you can opt out at any time.

On the logged-in dashboard (app.tovio.dev), PostHog records the type of screen you are on, page-load timings, client-side error reports, a named set of product events, and aggregated timings of the dashboard's calls to our Forge. It runs without a separate consent prompt.

Name	Provider	Purpose	Duration
`_ga`	Google	Distinguishes visitors for Google Analytics 4 (tovio.dev, docs.tovio.dev)	Up to 2 years
`_ga_<container>`	Google	Keeps session state for Google Analytics 4 (tovio.dev, docs.tovio.dev)	Up to 2 years
PostHog identifier (public sites)	PostHog	Anonymous identifier and opt-out flag for page views and error reports (localStorage)	Until cleared
PostHog identifier (dashboard)	PostHog	Anonymous identifier for dashboard screen views, page-load timings, error reports, and product events, and to link an error our Forge hits while answering the dashboard to the same session (localStorage)	Until cleared
Cloudflare Web Analytics	Cloudflare	Cookieless traffic measurement (no identifiers stored)	N/A

2.4 Marketing and advertising

We do not use marketing, advertising, or cross-site tracking cookies.

3. Third-party cookies and services

We use a few third-party services to help us monitor, analyze, and support our platform.

Google Analytics 4 (Google LLC): We use GA4 to understand traffic on tovio.dev and docs.tovio.dev. Its cookies are set on our own domain, and we deny advertising storage and ad personalization. Google's privacy policy describes how Google handles this data, and Google offers a browser add-on for opting out of Google Analytics.
PostHog (PostHog, Inc.): We use PostHog for page-view, page-timing, error and product-event monitoring. It stores an anonymous identifier in your browser's localStorage. On tovio.dev marketing and policy pages we also record a session replay: a reconstruction of what the page looked like and how you moved through it, with the values of anything you type masked before it leaves your browser. Replay is off on the repository explorer and on docs.tovio.dev. It runs on the signed-in dashboard under a much stricter rule: every piece of text is masked before it leaves your browser unless it is one of our own interface labels, link addresses, tooltips and form values are removed, and repository content — file contents, diffs, job logs, code editors and keys — is cut out of the recording entirely. You can turn it off for your browser in Settings. We do not use automatic click capture or build user profiles. A named set of events records, on our public sites, which version of the homepage you were shown and which links and buttons you used; and on the dashboard, which type of screen you opened, which actions you completed, how sign-in and checkout went, and whether the Forge answered. Dashboard screens are recorded as templates rather than addresses — a repository's proposals, never the repository's name — and query strings and fragments are removed before an event is sent. On our public sites it follows your consent choice; on the logged-in dashboard it runs without a separate consent prompt. PostHog's privacy policy describes how PostHog handles this data.
Cloudflare Web Analytics (Cloudflare, Inc.): We use Cloudflare to measure basic traffic on our public sites. This service is cookieless and does not store identifiers on your device. Cloudflare's privacy policy describes how Cloudflare handles this data.
Featurebase (CORDNET OÜ): Our feedback portal, help center, and support form (feedback.tovio.dev, help.tovio.dev, and support.tovio.dev) are hosted by Featurebase, which may set its own cookies on those hosts under its own privacy and cookie policies. The banner and consent cookie described on this page do not control them.

4. Do Not Track and Global Privacy Control

Global Privacy Control (GPC): On tovio.dev and docs.tovio.dev, we honor GPC. If your browser sends a GPC signal, we treat it as a refusal of consent and do not load Google Analytics or PostHog, wherever you are located. An explicit acceptance you make yourself on those sites takes precedence over the signal. GPC does not govern the logged-in dashboard.
Do Not Track (DNT): Our sites do not currently respond to Do Not Track signals, because there is no common industry standard for them. You can use GPC or the choices described below instead.

5. Your cookie choices

We tailor our consent approach to your location on our marketing and documentation sites (tovio.dev and docs.tovio.dev).

EEA, UK, Switzerland, Guernsey, Jersey, and the Isle of Man: If you visit from these regions (or if we cannot determine your location), you will see a consent banner with equal "Accept" and "Reject" buttons. No analytics tools load unless you click "Accept".
Rest of the world: Analytics tools load by default without a banner. You can opt out at any time with the button below or by sending a GPC signal.
Withdrawing consent: If you withdraw consent, we delete your Google Analytics cookies and stop PostHog monitoring on our public sites. The anonymous identifier PostHog kept in local storage remains until you clear this site's data.

Neither analytics nor browser monitoring is enabled on this deployment, so there is no choice to change.

Browser settings: You can also control or delete cookies and site data through your browser's settings; the help pages for Chrome, Firefox, Safari, and Edge explain how. If you block site data for app.tovio.dev, you will not be able to sign in to the TOVIO dashboard.

6. Cookie duration and data retention

How long a cookie or storage item stays on your device depends on its type:

Session storage: Items in sessionStorage (like your dashboard sign-in) are deleted when you close your browser tab.
Persistent storage: Items in localStorage, IndexedDB, or persistent cookies remain on your device until they expire or you clear them. Our tovio_consent cookie expires after 180 days. Google Analytics cookies remain for up to 2 years unless you withdraw consent, at which point we delete them. Data in localStorage and IndexedDB remains until you clear your browser data.

7. International data transfers

Tovio, LLC is based in the United States, and we use service providers that may process data outside your home country.

Google Analytics and Cloudflare process data primarily in the United States.
PostHog stores data in the United States or the European Union, depending on the region we use.
Featurebase (CORDNET OÜ) processes data in the European Union.

8. Changes to this cookie policy

We may update this Cookie Policy periodically to reflect changes in our technology, business practices, or legal requirements. When we do, we will update the "Last updated" date at the top of this policy, and we will ask for your consent again where the law requires it.

9. Contact us

If you have any questions about our use of cookies, browser storage, or your privacy choices, please contact us:

Company: Tovio, LLC
Email: privacy@tovio.dev
Website: tovio.dev
Address: 1300 South Boulevard STE 35425, Charlotte, NC 28203, United States

Contents