Cookie Policy

A cookie is a small file a site asks your browser to keep and send back on your next request. It is how a website recognises that two requests came from the same person, which is the only way anything can keep you signed in. Related technologies do the same job by other means: local storage keeps data in the browser without attaching it to requests, and a tracking pixel reports back to a third party.

This policy covers all of it, not just the things technically called cookies. It sets out every piece of data Koala stores on your device, what each one is for, how long it stays, and who can read it. It sits alongside our Privacy Policy, which covers the payroll, tax, and insurance records you send us for a premium review. If the two ever disagree about cookies, this page is the more specific one and we will fix the other.

There are two, and both are strictly necessary, meaning the service cannot do what you asked it to without them. Both are first party: they are set by this site, sent only back to this site, and no other company can read them.

• The sign-in session cookie. Set when you sign in with Google, by Supabase, the service that runs our authentication and database. Its name begins with sb- and ends in -auth-token, and because the token is longer than a cookie may be it is sometimes split across a numbered pair. It holds the token that proves to our servers which account you are, and without it every page would treat you as a stranger. It refreshes while you keep using the service and is cleared when you sign out.
• The entitlement cookie, koala_sub. Set only after a payment provider confirms an entitlement on your account, and it records which plan you are on so the right features unlock. Its value is a signed digest rather than readable text, so it cannot be edited into a plan you have not paid for. It is marked HttpOnly, which means page scripts cannot read it, restricted to same-site requests, sent only over an encrypted connection in production, and it lasts 90 days.

Neither cookie records where you go on the site, which pages you read, how long you stay, or anything about you outside Koala. Neither is readable by anyone but us. There are no others. If you inspect this site and find a third cookie, that is a bug and we would like to hear about it at koala.insurance.help@gmail.com.

It is worth stating in the negative, because almost every site you visit does at least one of these and you are entitled to assume we do too. We do not:

• run product analytics of any kind. No page view counter, no session recorder, no heatmap, and no funnel tracking. We do not know which pages you read.
• carry advertising or marketing pixels. There is no ad network tag, no conversion pixel, and no remarketing list built from your visit.
• set third party cookies. No other company sets a cookie through this site, so nothing here can follow you to another one.
• use social media embeds or share widgets, which are a common way for a third party cookie to arrive on a page without anyone intending it.
• profile you, build an advertising audience, or sell or share personal information for cross-context behavioral advertising, as described at greater length in our Privacy Policy.

We do not run a third party error monitoring tool either, which is genuinely useful and which most engineering teams would install without a second thought. If we add any of these, we will update this page and describe what it collects before we turn it on, and anything non-essential will get a real off switch rather than a notice.

Two things live in your browser's local storage rather than in a cookie. They are never sent to our servers on their own, and no other site can read them.

• Your business profile draft, stored under koala-brain. When you fill in details about the employer being reviewed before signing in, they are kept here so a refresh does not lose your work. Once you sign in, the profile lives in our database under row-level security instead. Because this sits on the device, do not fill it in on a shared or public computer.
• Your acknowledgement of the cookie notice, stored under koala.cookie-notice. It is the single value that stops the notice at the bottom of the page returning on every visit. It records that the notice was shown and nothing about you.

Clearing your browser's site data removes both. The profile draft is the one worth knowing about before you do it, because an unsaved draft is not recoverable afterwards.

You have seen a hundred banners with an Accept button and a Reject button. You will not see one here, and the reason is not that we skipped it.

Consent rules of the kind that produced those banners apply to storage that is not strictly necessary: analytics, advertising, and tracking. Cookies without which a service you asked for cannot function are outside them. Both of ours are in the second category. The sign-in cookie is how being signed in works, and the entitlement cookie is how a plan you paid for unlocks.

So a Reject button here would have nothing to switch off. It would present a choice that did not exist, and either quietly do nothing or break your sign-in to look meaningful. We would rather tell you what we store and let you check. The notice you saw states the facts and has one button, which acknowledges it. That is the whole of the mechanism. On the day we add something you should genuinely be able to refuse, you will get a real choice, and refusing it will actually turn that thing off.

Every browser lets you block or delete cookies, usually under Settings, then Privacy, then cookies and site data. You can clear what this site has already stored, block it going forward, or set the browser to clear everything when you close it. We do not override any of that, and we do not try to restore a cookie you deleted by another route.

What to expect if you block cookies for this site: the public pages, including this one, work normally, because reading the site sets nothing. Signing in will not work at all, as there is nowhere to keep the session, so sign-in will appear to succeed and then return you to a signed-out page. A paid plan will not unlock, because the entitlement cookie is what carries it.

Browser signals that ask sites not to track you, including Global Privacy Control and Do Not Track, have nothing to act on here, since there is no tracking, no sale of personal information, and no targeted advertising to stop. We honor them by not doing any of it rather than by switching something off when the header arrives.

We will update this page whenever what we store changes, and change the last updated date when we do. A new cookie or a new storage key is a change to the disclosure, not a wording tidy, so it also re-shows the notice to everyone who already acknowledged the old one: an acknowledgement of two strictly necessary cookies is not an acknowledgement of a third thing. Where a change adds anything non-essential, we will ask for your consent before it is turned on rather than after.

Questions about anything on this page, or about a cookie you found that is not listed? Email koala.insurance.help@gmail.com. Koala is operated by Abhinav Alwarappan. Please put "Cookies" in the subject line so it reaches the right place.