Legal
Cookie Policy
Brain sets no advertising, analytics or profiling cookies. There is no cookie banner because every cookie we set is strictly necessary to keep you signed in.
Why there is no cookie banner
Under the UK Privacy and Electronic Communications Regulations, storage that is strictly necessary to deliver a service you have asked for does not require consent. Every cookie Brain sets is in that category — they exist to keep you signed in and to protect the sign-in endpoint.
We still have to tell you about them, which is what this page is for. A banner asking permission for cookies we are permitted to set regardless would be theatre, and would make the question meaningless when it eventually matters.
What is actually set
The marketing site at the root of this domain sets no cookies at all for a signed-out visitor. The cookies below appear when you sign in.
| Name | Set by | Purpose | Category |
|---|---|---|---|
__session | Clerk | The session token that authenticates your requests | Strictly necessary |
__client_uat | Clerk | Signed-in-state indicator, so the server knows whether to attempt a session handshake | Strictly necessary |
__cf_bm | Cloudflare, in front of Clerk's authentication endpoint | Bot management on the sign-in endpoint | Strictly necessary (security) |
Clerk also uses browser local storage for authentication state. That is covered by the same strictly-necessary exemption.
What we do not do
No advertising cookies. No analytics or product telemetry. No session replay or heatmaps. No conversion pixels. No cross-site tracking. No fingerprinting. No A/B testing identifiers. No third-party embeds that set their own cookies.
This is not a promise about the future — it is a description of the current build, which contains no analytics code of any kind.
When this page will change
We are recording the trigger publicly so it is not quietly crossed. A consent mechanism — a banner, a stored preference, and blocking before consent — becomes legally required before any of the following is enabled for a single visitor:
- Any web or product analytics.
- Any session replay or heatmap tool.
- Any advertising or conversion pixel.
- Any A/B testing or feature-flag SDK that persists a per-visitor identifier in the browser.
- Any embedded third-party widget that sets its own cookies — support chat, scheduling, video with tracking enabled.
- Any first-party cookie used for marketing attribution, such as persisting campaign parameters.
Two edge cases we will treat as needing legal review rather than an automatic banner: server-side error monitoring, which sets nothing in the browser, and cookieless analytics — which may avoid the consent requirement but does not remove our duty to disclose it here and have a lawful basis for it.
Managing cookies
You can block or delete cookies in your browser settings. Blocking the strictly-necessary cookies above will prevent you from signing in.
Questions: hello@brayn.tech.