Legal
Fracton is made by Penteraction, Inc., and you sign up for it at penteraction.ai. This is the same document as penteraction.ai/cookies.
Penteraction, Inc. Cookie Notice
Last Updated: October 23, 2026
What this covers
This Cookie Notice explains what Penteraction, Inc. ("we", "us") stores on your device when you use our website and app, why we store it, and how to get rid of it. It is the notice referred to in our Privacy Policy.
Two things are worth saying up front. First, we set four cookies: two that keep you signed in, one that protects you from other sites acting as you, and one that remembers whether your sidebar was open. None of them tracks you, and we set none for advertising or analytics. Second, most of what we store is not a cookie at all. It is browser storage, which stays on your device and is not automatically transmitted anywhere. Everything is listed below by name. Nothing is omitted for being inconvenient.
What we store
Every item below is something the app actually creates on your device, listed by its real name. Where a name contains a value in angle brackets, the real key substitutes your account, conversation, or plan into that position.
Items marked strictly necessary cannot be turned off without breaking the thing they support (most importantly, staying signed in). Items marked preference exist only to remember a choice you already made; removing them costs you the choice, not the service.
Cookies
Small values sent to our server with requests. We set exactly four. The two session cookies are httpOnly. Your browser holds them but page scripts cannot read them.
| Name | Type | Purpose | Category | Retention |
|---|---|---|---|---|
| sb-access-token | Cookie | Keeps you signed in. Our API sets this when you sign in, and your browser sends it back on each request so we know the request is yours. It is httpOnly, meaning page scripts cannot read it. Only our server can. | Strictly necessary | 90 days |
| sb-refresh-token | Cookie | Renews your session in the background when the access token above expires, so you are not signed out mid-task. Also httpOnly. | Strictly necessary | 365 days |
| csrf_token | Cookie | Security. Proves a request that changes your data actually came from the app and not from another site impersonating you. The app reads this cookie and echoes it back in a request header; a request that cannot do that is rejected. | Strictly necessary | 24 hours |
| sidebar_state | Cookie | Remembers whether you left the navigation sidebar expanded or collapsed, so it renders the way you left it instead of flashing to the default on every page load. | Preference | 7 days |
Local storage
Values kept in your browser and never automatically sent anywhere. This is where most of what we store lives, including your session.
| Name | Type | Purpose | Category | Retention |
|---|---|---|---|---|
| sb-<project>-auth-token | localStorage | Keeps you signed in. Holds the access and refresh tokens for your session so you are not asked to sign in again on every page load. Your session is held in two places: here, where the app can read it, and in the httpOnly cookies listed above, which only our server can read. | Strictly necessary | Until you sign out or clear site data |
| sb-<project>-auth-token-code-verifier | localStorage | A one-time secret used to complete a sign-in securely (the PKCE flow). It exists only between starting and finishing a sign-in. | Strictly necessary | Deleted as soon as sign-in completes |
| ai_chat_offline_queue_v2 | localStorage | Holds messages you sent while your connection was down, so they are delivered rather than lost when you reconnect. Contains the text you wrote. | Strictly necessary | Until the queued messages are delivered |
| penteraction_clarification_draft_<id> | localStorage | Preserves an answer you are part-way through typing in response to a clarification question, so a refresh does not discard your draft. Contains the text you wrote. | Strictly necessary | Until the draft is submitted or cleared |
| vite-ui-theme | localStorage | Your light, dark, or system theme choice. | Preference | Until you clear site data |
| font | localStorage | Your typeface choice. | Preference | Until you clear site data |
| ai_chat_settings | localStorage | Your chat settings, so they persist between visits. | Preference | Until you clear site data |
| fracton:chat-sound-enabled | localStorage | Whether the chat notification sound is on or off. | Preference | Until you clear site data |
| ai-chat:command-history | localStorage | Your recent chat commands, so you can recall them. Contains text you typed. | Preference | Until you clear site data |
| penteraction_onboarding_state, onboarding_context_dump | localStorage | Your progress through onboarding and the answers you gave, so you can leave and resume without starting over. The context dump contains what you told us about your role, your current projects, and your pain points. | Preference | Until you clear site data |
| penteraction_dev_model_default, penteraction_dev_model_<conversation id>, penteraction_cost_limit_default, penteraction_cost_limit_<conversation id> | localStorage | Your model selection and per-conversation spend cap, remembered per conversation and as a default. | Preference | Until you clear site data |
| penteraction_submitted_clarifications_v2, penteraction_submitted_clarifications | localStorage | Which clarification prompts you have already answered, so you are not asked the same thing twice. The second key is a legacy version kept only so older sessions migrate cleanly. | Preference | Until you clear site data |
| chatPromptSuggestions, penteraction_chat_prompt_suggestions_dismissed | localStorage | Cached starter prompts and a record of which ones you dismissed, so dismissed suggestions stay dismissed. | Preference | Until you clear site data |
| hasSeenDecisionDeskSwipeTutorial | localStorage | Whether you have already seen the Decision Desk tutorial. | Preference | Until you clear site data |
| profile_completion_banner_dismissed, usage-banner-dismissed:<plan>:<cycle>, free-retirement-dismissed:<date>, paused-banner-dismissed:<plan>:<cycle>:<count> | localStorage | Which notification banners you dismissed, so a banner you closed does not immediately return. The date and cycle in the key are what allow a banner to reappear in a later billing cycle or on a later day. | Preference | Until you clear site data |
| DEMO_MODE | localStorage | Marks the app as running in demo mode, where it renders sample data and makes no backend calls. Only set on demo builds. | Preference | Until you clear site data |
Session storage
Values that exist only for the life of a browser tab and are discarded when you close it.
| Name | Type | Purpose | Category | Retention |
|---|---|---|---|---|
| SIGN_UP_DATA | sessionStorage | Carries your answers between the steps of the sign-up wizard so moving back and forth does not lose them. | Strictly necessary | Cleared when sign-up finishes or the tab closes |
| __redirect_path | sessionStorage | Remembers the page you were trying to reach when you were sent to sign in, so you land there afterwards instead of somewhere generic. | Strictly necessary | Cleared immediately after the redirect |
| __chunk_reload_at | sessionStorage | A timestamp that stops the app reloading in a loop when it recovers from a stale build after a deployment. | Strictly necessary | Cleared when the tab closes |
| penteraction.first_touch | sessionStorage | Written only when you sign in with Google, Apple, or another provider, so the account you create can record how you found us: the campaign tags in the link you followed, the domain of the site that sent you, and the first page you opened. The full address of that site and any ad click identifier are never kept. | Measurement | Removed when sign-in finishes, or when the tab closes |
| sentryReplaySession | sessionStorage | Set by Sentry to tie together one session of error diagnostics. See "Third-party services" below for what Sentry does and does not record. | Diagnostics | Cleared when the tab closes |
What we do not use
We do not use advertising or cross-site tracking cookies. We do not load advertising or analytics scripts, we do not use web beacons or tracking pixels, and we do not run an advertising network, a social media pixel, or a product analytics SDK on this site. Nothing in the list above is used to build a profile of you, to follow you across other websites, or to sell or share information about you with advertisers.
This is a description of the software as it is built, not a statement of intent. You can check it: open your browser’s developer tools, look at the cookies and storage for this site, and compare them to the table above. If you find something in your browser that is not on this list, that is a bug in this notice, and we want to know.
Because we set no advertising or analytics cookies, there is no consent banner to click through. The one item above that is neither necessary nor a preference is the sign-up source marked Measurement. It exists only in the tab where you sign in with a provider such as Google or Apple, it holds only how you arrived, and it is gone when that sign-in finishes.
Third-party services
We use a small number of third parties to run the service. Each one is named below with what it does for us and exactly what, if anything, it stores on your device. Their own privacy policies govern what they do with what they receive.
Supabase
Authentication and database
Stores your signed-in session in local storage under sb-<project>-auth-token. The Supabase library itself sets no cookies; our own API writes the same session tokens into the sb-access-token and sb-refresh-token cookies listed above.
Sentry
Error monitoring
Records diagnostics when something breaks, so we can fix it. It sets no cookies; it stores one session-storage value (sentryReplaySession). Session replay is enabled on production builds for 10% of sessions, and for any session in which an error occurs. Replay is configured with Sentry’s defaults, which mask all text and all form inputs and block media, so a replay records the shape of what happened, not the words on your screen.
Stripe
Payments
Stores nothing on this site. We do not load Stripe’s scripts here. When you start a checkout or open the billing portal, we send you to a page hosted by Stripe. Anything Stripe stores, it stores there, under its own policy, and we never see your card details.
Stripe Privacy PolicyMore information
For the full picture of what information we collect, why, how long we keep it, and the rights you have over it, see our Privacy Policy. This notice is the detail behind that policy’s section on cookies and tracking technologies.
If we start storing something new on your device, we will add it to the table above. Where a change is significant, we will update the date at the top of this notice.