Cookie policy
Last updated 2026-10-22
ClearSubmittal uses one optional analytics tool, Google Analytics 4, and only if you allow it through the consent bar shown on your first visit. We use no advertising cookies and no cross-site tracking for advertising. Everything else this site stores in your browser is strictly necessary, and this page lists it item by item.
1. What we use, and when we ask
Strictly necessary storage is what the site needs to sign you in or to provide a feature you asked for, such as connecting an app or keeping the API key you typed into the API documentation page. It needs no consent under the ePrivacy rules, so we do not ask for it. Analytics is different: it needs your opt-in. You give or refuse it in the consent bar shown on your first visit, and you can change your choice at any time with Cookie settings in the footer of any public page. Until you allow it, nothing is loaded from Google and no analytics cookie is set.
2. What we actually store, item by item
| Item | Where | Purpose | Cleared |
|---|---|---|---|
| Sign-in tokens (ID token, access token, refresh token) | Browser sessionStorage, not a cookie |
Keeps you signed in while you use the dashboard. The refresh token renews the session without asking you to sign in again, so you are not signed out while you are working | When you close the browser tab, or when you sign out |
| OAuth consent request | Browser sessionStorage (key appcore.oauth.pending.v1), not a cookie |
Only when you connect an AI app to your account. Remembers which app's request you are answering while you sign in, so the consent screen can come back after sign-in | When you allow or decline, after 10 minutes, or when you close the tab |
| Swagger UI authorization | Browser localStorage (key authorized), not a cookie, only on the API documentation page |
Only if you enter an API key in Swagger UI: remembers it so you do not have to paste it again on the API documentation page | Until you log out in Swagger UI or clear site data for clearsubmittal.com |
| PKCE verifier and state | Browser sessionStorage, not a cookie |
Each time this site sends you to the ClerkRow sign-in page, https://clerkrow.com/signin, to sign in. Strictly necessary: proves the sign-in came back to the same browser that started it (PKCE, part of the sign-in flow) | Once sign-in completes, or when you close the tab |
| Cognito sign-in session cookies | Cookies, set by AWS on the ClerkRow Amazon Cognito sign-in domain (auth.clerkrow.com), only when you choose "Continue with Google" and the sign-in redirect passes through that domain |
Strictly necessary: completes the sign-in redirect | When you sign out, or per Amazon Cognito's own session lifetime |
| Consent choice | Browser localStorage (key appcore.consent.v1), not a cookie |
Remembers whether you allowed analytics, so we do not ask on every page. Strictly necessary | 12 months, then we ask again, or when you clear site data for clearsubmittal.com |
_ga |
First-party cookie set by Google Analytics on clearsubmittal.com, only after you allow analytics | Distinguishes visitors, so that the pages read can be counted | 2 years |
_ga_<id> |
First-party cookie set by Google Analytics on clearsubmittal.com, only after you allow analytics | Keeps the state of a visit | 2 years |
Signing in, creating an account or resetting a password with email and password happens on the one ClerkRow sign-in page, https://clerkrow.com/signin, not on this site. That page sends your details directly to Amazon Cognito over an encrypted connection and sets no cookie. So that you are signed in on every ClerkRow tool, it keeps your ClerkRow sign-in in its own browser storage on clerkrow.com (localStorage, not a cookie, for at most 30 days or until you sign out); it is strictly necessary, and this site cannot read it.
Apart from the Google Analytics cookies you choose to allow, none of the above is used for analytics, profiling, or advertising, and none of it is shared with a third party for those purposes. The Google Analytics cookies are used for analytics only, never for advertising or profiling.
3. Google Analytics
If you allow analytics, we use Google Analytics 4 to understand which pages are read, so we can improve the site. It collects the pages you view, the page that referred you, your approximate location (derived from your IP address, which Google Analytics 4 does not log or store), your device and browser type, and a pseudonymous identifier kept in the _ga cookies.
Google Ireland Limited provides Google Analytics and acts as our processor. Google LLC in the USA may process the data too; see the privacy policy for the safeguards. Google Signals and ad personalisation are turned off, and we do not use this data for advertising.
Google Analytics loads only on the public pages of this site, never on the dashboard or the sign-in pages. Its event data is kept for 14 months and then deleted automatically. Before you allow analytics, your browser does not contact Google for it. Once you do, your browser contacts www.googletagmanager.com and Google Analytics servers (*.google-analytics.com and *.analytics.google.com), which then see your IP address and browser details, as any server does for a file it serves.
4. API documentation page
Our API documentation page at /api/public/docs is built with Swagger UI. It loads Swagger UI's stylesheet and script from cdnjs.cloudflare.com, a public code library service run by Cloudflare. Both files are pinned to one version and checked with Subresource Integrity hashes, so your browser refuses a changed copy. Your browser sends a request to cdnjs when it opens that page, and cdnjs sees your IP address and browser details as it would for any file. cdnjs sets no cookie for us. The only other files this site loads from a third party come from Google, and only if you allow analytics (see Google Analytics above).
If you enter an API key in Swagger UI, it keeps the key in localStorage on this site, as listed in the table above. That storage stays on your device. We do not read it, and it is not sent anywhere but with your own API requests from that page.
5. How you can manage cookies
Choose Cookie settings in the footer of any public page to allow or withdraw analytics at any time. Withdrawing deletes the _ga cookies on this site and stops Google Analytics from loading. If you'd also like to review or clear what your browser holds, every modern browser lets you inspect and delete site data from its settings (often under "Privacy" or "Site settings"). Clearing site data for clearsubmittal.com also resets your choice, and will sign you out.
6. Changes to this policy
If we ever add another optional feature that needs a non-essential cookie, we will update this page before doing so, not after.
7. Contact
Questions about this policy: hello.invalid [at] clearsubmittal [dot] com.