Last updated: July 4, 2026
Cookies are small text files stored on your device when you visit a website. They are widely used to make websites work efficiently and to provide information to site operators.
Draftli uses strictly necessary cookies by default. With your explicit consent, we additionally set two independent categories of optional cookies: analytics cookies for Google Analytics 4, which let us measure aggregate usage of Draftli, and advertising cookies for Google Ads conversion tracking, which help us understand which campaigns bring creators to Draftli. Neither category is set unless you opt in to it, and the two choices are independent of each other.
| Cookie | Purpose | Duration |
|---|---|---|
| sb-*-auth-token | Authentication session managed by Supabase. Keeps you signed in. | Session |
| sb-*-auth-token-code-verifier | PKCE code verifier for secure OAuth flows. | Session |
| draftli_demo_unlock_* | HMAC-signed token that unlocks a demo project's download after the demo checkout completes. Grants access to that one demo project only and cannot authenticate as any account. | ~2 minutes |
We use Google Analytics 4 (GA4) to understand aggregate usage of Draftli — pageviews, product events (such as project creation, payment completion, and subscription activation), real-user performance metrics, and aggregate revenue figures. GA4 sets the first-party cookies listed below, and Google acts as our processor, processing this data in the United States under the EU–US Data Privacy Framework. These cookies are set only with your Analytics consent— after you click "Accept" on our cookie banner or enable Analytics from the preferences below. When Analytics consent is denied, Google may still receive aggregated, cookieless signals (Google Consent Mode), but nothing is stored on or read from your device. Learn more at policies.google.com/privacy.
| Cookie | Purpose | Duration |
|---|---|---|
| _ga | Google Analytics — distinguishes users so visits can be aggregated. | ~2 years |
| _ga_<STREAM> | Google Analytics — persists session state for the data stream. | ~2 years |
With your explicit consent, Draftli uses Google Ads conversion tracking to measure which marketing campaigns lead creators to subscribe. The cookies listed below are set on your device only after you click "Accept" on our cookie banner or allow ad measurement from the preferences below. You can withdraw your consent at any time and the cookies will no longer be set on future page loads.
| Cookie | Purpose | Duration |
|---|---|---|
| _gcl_au | Google Ads conversion linker; correlates ad clicks with subscription conversions. | 90 days |
| _gcl_aw | Google Ads click identifier (gclid). | 90 days |
| _gcl_dc | Google Ads DoubleClick click identifier. | 90 days |
For more information about how Google uses these cookies, see Google's advertising and cookies policy.
You can change your Analytics and Advertising consent at any time from this page or from your account settings. The two toggles are independent, and strictly-necessary cookies are always on.
Strictly necessary
Required for sign-in, security, and core functionality. Always on.
Analytics (Google Analytics 4)
Helps us understand how the product is used so we can improve it.
Advertising (Google Ads)
Measures which ad campaigns bring creators to Draftli.
Draftli stores a single small key in your browser's localStorage — draftli.consent.v1 — to remember your advertising-measurement consent choice. It is strictly necessary, is not a cookie, and is never sent to a server.
On a review page, Draftli stores draftli_author_nameto remember the display name you type so you don't re-enter it on your next comment; it is strictly necessary, stays in your browser, and is never used for tracking.
Draftli also stores draftli_author_token — a random value stored so you can edit or delete the comments you post on a review page; it contains no name or personal information, is strictly necessary, and only a one-way hashed form is ever stored on our servers.
On pages where Draftli redirects you back from Stripe (after checkout or subscription) we also use sessionStorage briefly to de-duplicate one-time analytics events on browser refresh. Keys are prefixed ga.fired., contain only the value 1, are scoped to the current browser tab, and are never sent to a server.
When you interact with Stripe's payment forms on Draftli, Stripe may set its own cookies for fraud prevention and payment processing purposes. These cookies are governed by Stripe's Privacy Policy.
When you sign in, sign up, or submit a comment on a review page, Cloudflare Turnstile may set strictly-necessary cookies on challenges.cloudflare.com to protect against bots and abuse. These cookies are governed by Cloudflare's Privacy Policy.
You can control and delete cookies through your browser settings. Please note that disabling essential cookies may prevent you from using certain features of the Service, such as staying signed in.
Most browsers allow you to:
We may update this Cookie Policy from time to time. Changes will be posted on this page with a new "Last updated" date.
If you have questions about our use of cookies, contact us at privacy@draftli.io.