Cookie Policy
QualCanvas uses a small number of cookies plus browser local-storage. This page lists each one.
Strictly necessary
These can't be disabled without breaking core functionality.
| Name | Purpose | Lifetime |
|---|---|---|
| jwt | Authenticated session. HttpOnly, SameSite=Lax. | 24 hours |
| jms_cookie_consent | Local-storage record of your optional analytics choice. | Until you change it or clear site data |
| qualcanvas-* / canvas-* | LocalStorage for canvas UI state, feature flags, onboarding progress, offline cache. | Persists until cleared |
| jms_chat | Keeps your support-chat conversation available while this browser tab is open. | Browser session |
| jms_chat_dismissed | Remembers that you closed the support-chat button. | 24 hours |
Optional analytics & conversion measurement
Google Analytics, Google Ads conversion measurement and Meta conversion measurement remain disabled until you accept the banner. Cookieless Plausible analytics loads on public marketing pages and does not use an advertising identifier.
| Name | Purpose | Lifetime |
|---|---|---|
| _ga / _ga_* | Google Analytics 4 — aggregate page views, retention. | 2 years |
| _gcl_* | Google Ads — consented conversion attribution. | Up to 90 days |
| _fbp / _fbc | Meta — consented conversion attribution. | Up to 90 days |
Operational observability
Sentry may use a short-lived sentry-trace value to connect frontend and backend errors. We use this for service reliability, not advertising, and QualCanvas does not enable Sentry Session Replay because research content can be sensitive.
Boundaries
- No optional analytics or advertising measurement is loaded before you accept.
- No third-party social-button cookies on logged-out pages.
- No fingerprinting beyond what Cloudflare / Sentry use for security & error attribution.
Managing cookies
- In-app: open the consent banner via the footer "Cookie settings" link to turn optional measurement on or off. Withdrawing consent stops the measurement container and clears known first-party analytics cookies.
- In your browser: standard browser settings let you delete or block any of these. Deleting the
jwtcookie will log you out. - Opt-out across sites: consider a tool like uBlock Origin or your browser's built-in tracking-protection toggle.
Last updated: 2026-08-27.