Loading…
Effective date: April 28, 2026
This Cookie Policy explains how Doclator ("we", "us", "our") uses cookies and similar storage technologies on doclator.com and related domains. It should be read together with our Privacy Policy.
By continuing to use the Service, you consent to the use of cookies and storage technologies as described below. You can withdraw consent at any time by clearing your browser storage or by using the controls described in Section 6.
Cookies are small text files placed on your device by a website. They help the website remember information about your visit, such as your preferred language and login state, so subsequent visits are faster and more useful.
Local storage and session storage are similar mechanisms built into modern browsers that allow a website to store small amounts of data on your device. Doclator uses local storage instead of cookies to hold authentication tokens, because it provides better cross-origin behavior for our API.
We refer to all of these technologies collectively as "cookies" throughout this policy unless we need to be specific.
We use cookies and similar storage to:
We do not use cookies for advertising, retargeting, or building marketing profiles. We do not sell or share cookie-derived data with advertising networks.
Required for the Service to function. They cannot be disabled without breaking core functionality.
| Name | Purpose | Storage | Duration |
|---|---|---|---|
| access_token | JWT used to authenticate API calls | Local storage | Up to 7 days |
| refresh_token | Opaque token to silently rotate the access token | Local storage | Up to 30 days |
| realtime_token | Short-lived JWT for live job-progress channel | Local storage | Up to 1 hour |
Remember your preferences so the Service feels personalized.
| Name | Purpose | Storage | Duration |
|---|---|---|---|
| theme | Light, dark, or system theme preference | Local storage | Persistent until cleared |
| NEXT_LOCALE | Selected interface language | Cookie | 1 year |
Used to detect bots, enforce rate limits, and protect against fraud.
| Source | Purpose | Duration |
|---|---|---|
| Vercel | DDoS protection and request routing | Session |
| Upstash Redis | Rate-limit identifiers (server-side, not stored in your browser) | Up to 24 hours |
Help us understand how the Service is used in aggregate.
| Provider | Purpose | Duration |
|---|---|---|
| Vercel Analytics | Page views, top pages, traffic sources (privacy-friendly, no fingerprinting) | 24 hours per visitor |
Capture errors so we can debug and fix them quickly.
| Provider | Purpose | Duration |
|---|---|---|
| Sentry | Crash reports, stack traces, slow-transaction tracing | 90 days |
Some pages of the Service include third-party features that may set their own cookies:
We have no control over third-party cookies. Please consult each provider's policy: Stripe, Lemon Squeezy, Paddle, Google, Microsoft.
Authentication tokens (access_token, refresh_token, realtime_token) are stored in your browser's local storage rather than HTTP-only cookies. This is a deliberate trade-off to support cross-origin API access without CSRF tokens. We mitigate the corresponding XSS risk through a strict Content Security Policy, automatic React output escaping, and short-lived tokens that rotate on every login.
You can control cookies and local storage in several ways:
Disabling strictly necessary cookies will break sign-in, file uploads, and other core features.
We may update this Cookie Policy from time to time to reflect new features or regulatory guidance. Material changes will be flagged in this page's effective date and, where required, by an in-app notice. Continued use of the Service after the updated effective date constitutes acceptance of the revised policy.
Questions about cookies or storage? Email us at privacy@doclator.com.
Last updated: April 28, 2026