# Cookie policy

> **Draft — pending review by a solicitor. Not yet in force.**

Last updated: 10 October 2026

Fyle uses a small number of cookies to keep you signed in and secure, and remembers a couple of display choices you make. We don't use advertising or tracking cookies, so we don't show a cookie banner. This page lists every cookie and storage item we set.

## 1. What cookies are

Cookies are small files a website stores in your browser. Similar technologies, such as your browser's local storage, work in a similar way. The Privacy and Electronic Communications Regulations (PECR) require consent before storing or reading them, unless they are strictly necessary for a service you have asked for.

## 2. Cookies we set

All of these are first-party cookies set by fyle.sh. None are used for advertising or to track you across other sites. The authentication cookies are set by Better Auth, the sign-in software we run on our own servers, and are signed and HttpOnly, so scripts in the page can't read them.

| Name | Type | What it does | How long | When it is set |
| --- | --- | --- | --- | --- |
| `__Secure-fyle.session_token` | Strictly necessary | Keeps you signed in. Signed, HttpOnly, SameSite=Lax; holds a random session token, not your details. | Up to 30 days, or less if your organisation's session policy is stricter. Removed on sign-out. | Set when you sign in |
| `__Secure-fyle.session_data` | Strictly necessary | A signed copy of your session so most pages can check you are signed in without a database lookup. HttpOnly. | 5 minutes, refreshed while you use the app | Set when you sign in |
| `__Secure-fyle.two_factor` | Strictly necessary | Links the password step of sign-in to the two-factor step. Signed, HttpOnly. | 10 minutes | Set during sign-in if you use two-factor authentication |
| `__Secure-fyle.trust_device` | Strictly necessary | Remembers that you chose to trust this browser, so it doesn't ask for a two-factor code every time. Signed, HttpOnly. | 30 days | Set only if you tick “Trust this device for 30 days” at the two-factor step |
| `sidebar_state` | Preference (set at your request) | Remembers whether you collapsed the dashboard sidebar. | 7 days | Dashboard, set when you open or close the sidebar |

On fyle.sh the sign-in cookie names start with `__Secure-`, which tells browsers to accept them only over HTTPS.

## 3. Local storage

| Name | Type | What it does | How long | When it is set |
| --- | --- | --- | --- | --- |
| `theme` | Preference (set at your request) | Remembers light or dark mode. Stays in your browser and is never sent to us. | Until you choose “system” or clear site data | Any page, set when you pick light or dark |

## 4. Analytics

We don't use analytics cookies. We plan to use Cloudflare Web Analytics to count page views. It doesn't set cookies or use local storage, and Cloudflare states it does not fingerprint visitors or track them across sites. It reports aggregated figures such as page views, referrers and country.

Our hosting provider, Cloudflare, also keeps standard request logs (IP address, browser, page requested) to deliver and protect the site. If we turn on Cloudflare bot protection, it may set a strictly necessary security cookie (such as `__cf_bm`); we will list it here before we do.

## 5. Why there is no cookie banner

Everything listed above is either strictly necessary (signing in, two-factor, security) or remembers a choice you made at the time you made it (light or dark mode, sidebar open or closed). PECR does not require consent for these, so we don't ask for it.

If we ever add a cookie or similar technology that is not strictly necessary, such as analytics cookies, we will ask for your consent first, keep it off until you agree, and let you change your mind at any time.

## 6. How to control cookies

You can block or delete cookies in your browser settings. If you block the strictly necessary cookies you won't be able to sign in. Choosing “system” in the theme switcher removes the saved theme.

## 7. Questions

Email [privacy@fyle.sh](mailto:privacy@fyle.sh). See also our [privacy policy](/legal/privacy).