Cookie Policy

Last updated 8 October 2026

This policy explains what Cusentra Mail stores in your browser, why, for how long, and how to control it. It sits alongside our Privacy Policy.

1. Cookies and browser storage

A cookie is a small file a website asks your browser to keep and send back. Browser storage (localStorage, sessionStorage, IndexedDB and the cache) is the same idea without being sent back automatically. The law treats them alike, so this page covers both. Everything listed here is ours: we set no cookies for anyone else.

2. The cookie we set

Name	What it is for	How long	Type
session	Keeps you signed in; carries the security token that protects every form and button from forged requests; notes the day we last recorded that the account was used (for the two-year inactivity rule in our Privacy Policy); holds short-lived state while you connect Google. Only our server can read it (HttpOnly), it is sent only over HTTPS, and only on visits that start on this site (SameSite=Lax).	30 days, renewed while you use the Service; deleted when you sign out	Strictly necessary

Before you sign in, the sign-in, sign-up and password pages set the same cookie holding only the security token for their form. Our home page and our legal pages set no cookie at all.

3. What we keep in your browser

What	Why	How long	Type
A copy of recent mail (IndexedDB agentra-mail-<your account id>): messages you opened or the inbox fetched ahead, attachments you opened, inbox pages, drafts you are writing, Cusentra Chat conversations and your report notes	So mail opens with no wait, and a half-written draft survives a closed tab	Each item at most 7 days, at most 400 of each kind; deleted at sign-out	Functional. Never leaves your device; deleted when you sign out, or when you clear this site's data in your browser
Actions on their way (IndexedDB and sessionStorage)	An archive, label or delete you made is kept until our server confirms it, so it is not lost if the connection drops	Until confirmed; at most 24 hours	Strictly necessary
Today's activity (IndexedDB): which messages you opened and acted on today, as message ids and times, and the folder you chose for saving reports	Builds the Daily Report you ask for; it is sent to us only with that report	Until you sign out or clear it	Functional
Launch Agent and reply state (localStorage): a run's prompt, the senders, subjects and notes it is working through, and which messages already have a drafted reply	So a run you started carries on across pages	Until the run ends; deleted at sign-out	Functional
Preferences (localStorage): theme, sidebar and toolbar layout, the plan notice you already saw, the message and list you came from	Remembers how you like the app	Until you change them or sign out	Preference
Panel state (sessionStorage): Cusentra Chat's search switch, banners you dismissed	Keeps the current tab as you left it	Until the tab closes	Functional
The voice model (browser cache, about 40 MB) - only after you first use voice dictation	Speech is turned into text inside your browser; your audio never leaves your device	Until you sign out or clear this site's data	Functional
App files (browser cache)	Copies of the app's own pages and scripts, to start faster	Replaced when the app updates; deleted at sign-out	Functional

We never keep in your browser storage your passwords, your Google app password, access tokens, the form security token, or the files of attachments you did not open. Signing out deletes everything above and tells your browser to clear this site's storage and cache (your theme comes back from your account when you sign in again); deleting your account does the same.

4. Other companies

No other company is contacted while our pages load, and we use no analytics, advertising, social-media or tracking services. Others are reached only when you ask for something they provide:

• Paddle - when you press a checkout button or Manage billing on the Plans page, Paddle's checkout loads from Paddle, which may set its own cookies to process the payment and prevent fraud (Paddle's cookie and privacy policies apply).
• Google - when you press Connect Google, you sign in on Google's own pages.
• Voice dictation - the first time you press the microphone, your browser downloads the speech library from jsDelivr and the speech model from Hugging Face. Both see your IP address, as any download does; neither receives your audio.
• Pictures inside an email - an email can contain images or styles stored on the sender's servers. When you open it, your browser fetches them from there, which can tell the sender that, and when, you opened it, and from what network address. This is how email works in every mail program; we add no tracking of our own.

5. Why there is no cookie banner

Everything in sections 2 and 3 is there to provide the service you asked for: signing you in, protecting your account, not losing your actions, mail that opens instantly, and remembering how you like the app. None of it tracks you, none of it is shared with anyone, and it stays in your browser until you sign out or clear it. The law in the EU and the UK lets a service store what it needs to provide the service you asked for without a consent banner, provided it explains it clearly; this page is how we do that. We would ask before using anything else, and today there is nothing else.

We do not sell or share personal data, so a Global Privacy Control signal from your browser has nothing further to switch off; we honour it all the same.

6. How to control it

• Sign out: deletes this site's storage and cache in that browser, including the copy of recent mail.
• Your browser: delete this site's cookies and data at any time, or use a private window. Blocking our one cookie means you cannot stay signed in.

7. Changes and contact

When we add or change anything listed here, we update this page and its date first; anything that would need your consent will ask for it before it is used. Questions: danish@cusentra.com.