Cookie Policy

Authentication cookies are set with security protections such as HttpOnly, Secure in production, and SameSite controls. Customer-branded inbox hostnames use host-specific cookies so one customer hostname does not receive another hostname’s session.

The inbound inbox may store an unsent reply or forward draft and your most recently selected receiving-domain filter in your browser’s local storage. Draft keys identify the message and draft type; the filter is scoped to the active workspace and stores only the selected domain name. This data remains on that browser until you send or clear the draft, choose all domains, clear site data, or the application removes it. Do not use a shared device for sensitive drafts.

Most browsers let you inspect, block, or delete cookies and local storage. Blocking essential authentication storage will prevent sign-in or cause the application to stop working correctly. Leaving “Remember me” unchecked keeps the refresh cookie session-only. You can also sign out and clear site data from your browser.

Tracking pixels and redirect links in emails are not browser cookies, but they can record an open or click when a Hivsy customer enables those features. The Privacy Policy explains that processing. Recipients can generally block remote images in their mail client and should use the sender’s privacy and unsubscribe controls.

Hivsy will update this Policy if storage practices materially change and will request consent before using non-essential cookies where law requires it. Questions may be sent to privacy@hivsy.com.