Cookie Policy

Throughplan uses as little browser storage as it can. Without your consent it sets nothing beyond what signing in requires, and loads nothing from anyone else. If you accept optional cookies, it also loads Google Tag Manager, which is described in its own section below. This policy lists everything Throughplan stores in your browser or desktop app, and why.

Both cookies are essential, so they are set without asking. Without them you cannot sign in.

• Session cookie (better-auth.session_token; on our live site the name starts with __Secure-). Keeps you signed in, in the browser and in the desktop app. Set when you sign in; valid for 7 days and renewed while you use the product; removed when you sign out. It is signed, cannot be read by page scripts, and is sent only over HTTPS to our own site.
• Sign-in state cookie (better-auth.state). Only while you sign in with Google, to check that the answer coming back from Google belongs to the sign-in you started. It expires after 5 minutes.

The apps keep a few settings in local storage, under names starting with “throughplan.”. They stay on your device and are never used to track you:

• your language and your light or dark theme;
• your cookie choice, so the banner does not ask again;
• which release notes you have seen, and whether you finished the introductory tour;
• how you like the project list shown (grid or list) and your email notification preference;
• in the desktop app: the project you have open, your canvas display options, and which AI tool the engine uses (kept in a settings file in the app’s data folder).

Three things are optional. If you choose “Accept” in the cookie banner, or switch diagnostics on in Settings → Legal & privacy: your browser sends a technical report to our error-monitoring provider (Sentry) whenever something breaks; while you are signed in, the pages you open are counted against your account; and your browser loads Google Tag Manager, described in the next section. The first two set no cookie and store nothing on your device apart from your choice.

If you choose “Decline”, or make no choice, your browser sends no error reports, your page views are counted against no one, and no tag manager and no measurement or advertising tag is loaded at all — not loaded and restrained, but never fetched. The banner asks every visitor who has not decided, also after signing in; accepting the Terms of Service is not this consent.

You can change your choice at any time in Settings → Legal & privacy, or by clearing this site’s stored data, after which the banner asks again. Withdrawing consent stops error reporting on the spot and tells the tag manager to store nothing and send nothing further; the page is free of it again as soon as you reload. Cookies its tags already set stay until you delete them in your browser, which the last section explains. Error reports from our servers are described in the Privacy Policy.

If you accept optional cookies, your browser loads Google Tag Manager from Google Ireland Limited. The tag manager itself collects nothing; it loads the measurement tags we have configured, which is how we understand which of our pages people arrive on and whether an advertising campaign of ours brought them.

Those tags may set cookies in your browser. The ones we expect are Google Analytics (“_ga” and a second name beginning “_ga_”, which distinguish one browser from another for up to two years) and Google Ads (“_gcl_au”, which attributes a visit to a campaign for 90 days). Which tags run is a setting we control, so this list describes what the tags are for rather than promising an unchanging set of names; the current cookies are always visible in your browser’s storage for this site.

What a tag receives is the path of the page you opened, its title, and what your browser sends with any request, including your IP address. For screens inside the product we send the shape of the address (for example /projects/:id) rather than the address itself, so no project, workspace or account identifier reaches Google. Google acts as our processor for this and processes the data in the United States under the EU–US Data Privacy Framework; the Privacy Policy sets out the transfer safeguards.

Before anything is loaded, the tag manager is told that every optional purpose is denied, and your acceptance is what changes that — so a tag can never assume a consent you did not give.

Separately from the tag manager, and whatever you choose, the product usage records and page views described in the Privacy Policy are counted on our own servers. Counting them uses no cookie, local storage or device identifier of its own, and no third party receives them. A page view is linked to your account only when you are signed in and have accepted optional diagnostics.

You can delete or block cookies in your browser settings. Blocking the session cookie prevents signing in; deleting it signs you out. Deleting this site’s cookies also removes any the measurement tags set, and clearing its stored data makes the consent banner ask you again.

Questions about cookies: info@throughplan.com.