Cookie policy
This page lists the trackers Servor places on your device and how to control them. No advertising cookies, no sale of data. The only non‑essential trackers help us understand how the app is used, and are only placed with your consent. This is a courtesy translation; in the event of a discrepancy, the French version prevails.
1. Applicable framework
Article 82 of the French Data Protection Act, which transposes the ePrivacy directive, subjects any reading or writing of information on your device to prior consent, except for trackers strictly necessary to deliver a service you expressly requested. A banner therefore asks for your choice on your first visit, with two answers of equal weight: "Accept all" or "Essential only". Until you answer, no non‑essential tracker is placed.
2. Strictly necessary cookies
Exempt from consent: without them, signing in to the Service is impossible.
| Name | Purpose | Duration | Issuer |
|---|---|---|---|
__session | Keeps the authenticated session | 7 rolling days | Clerk |
__client_uat | Inactivity detection and security checks | Session | Clerk |
servor_locale | Remembers the display language | 1 year | Servor |
servor_consent | Remembers your cookie choice | 6 months | Servor |
3. Trackers that require your consent
Placed only if you choose "Accept all".
| Name | Purpose | Duration | Issuer |
|---|---|---|---|
ph_<project>_posthog | Usage analytics and session recording, linked to your account | 1 year | PostHog (EU) |
servor_acq | Originating campaign (UTM parameters, referring site) sent at sign-up | 30 days | Servor |
PostHog measures pages viewed, clicks and steps completed, and records the session so we can see where a flow gets stuck. This data is linked to your account (Clerk identifier, email, name) and hosted in the European Union (Frankfurt). The recording masks everything you type and never includes the terminal, the file editor, command output, logs, the AI copilot or the recovery key: Servor's zero‑knowledge model is unaffected. The script is served from our own domain and loads no third‑party code.
4. Browser local storage
In addition to cookies, the Service writes information to your browser's local storage, which is also covered by article 82:
servor.team— remembers the active team so it can be restored between visits. Strictly necessary. Persists until you clear the site's data.ph_*— PostHog session state. Only with your consent, erased if you withdraw it.
Your vault decryption key, by contrast, is never written to disk: it stays in memory for the duration of the session and disappears on lock, sign‑out or tab closure.
5. Cookieless audience measurement
Whatever you choose, Servor uses Vercel Web Analytics to measure site traffic. According to its publisher, this tool places no cookie and writes nothing to your device. It is limited to aggregate indicators (pages viewed, referrer, device type, country), allows neither cross‑site tracking nor profiling, and relies on our legitimate interest in measuring traffic to our own site.
6. Payment cookies
When you enter a payment method, Stripe places its own technical cookies within its secure frame, necessary for fraud prevention and PCI‑DSS obligations. See Stripe's cookie policy.
7. Changing or withdrawing your choice
Withdrawing consent is as easy as giving it. The "Manage cookies" link, in the footer and below, reopens the banner; choosing "Essential only" stops collection immediately and erases the PostHog and attribution trackers from your browser.
You can also:
- configure your browser to block some or all cookies — blocking the strictly necessary ones makes signing in impossible;
- delete already stored data through your browser settings (Preferences → Privacy → Cookies and site data);
- use private browsing, which clears everything when the window is closed.
To have usage data already collected erased, write to hello@servor.app.
8. Maximum duration
In line with CNIL recommendations, the lifetime of trackers placed by Servor does not exceed 13 months, and your choice is asked again after 6 months at the latest. Session cookies expire when the browser is closed or after a period of inactivity.
9. International consistency
We apply the same, most protective regime everywhere: prior consent for any non‑essential tracker, whichever country you connect from. It satisfies the GDPR and the ePrivacy directive in the European Union, UK GDPR and PECR in the United Kingdom, the FADP in Switzerland, the LGPD in Brazil, PIPEDA in Canada and US state laws (CCPA/CPRA in California, and the equivalent laws of Colorado, Virginia and Connecticut, among others).
We honour the Global Privacy Control signal: a browser that sends it is treated as having chosen "Essential only", without the banner being shown. We carry out no "sale" or "sharing" of data for advertising purposes within the meaning of those laws.
10. Changes
This policy is updated whenever a tracker is added or removed. Material changes are flagged through the interface and on this page.
Questions: hello@servor.app