Cookies Policy

DRAFT — not lawyer-reviewed. Planning artifact for internal review and counsel polish. Do not publish, link from the marketing site, or present to users until reviewed by qualified legal counsel.

Product alignment: Default categories match CONTEXT.md and PLAN.md — Essential cookies always on; Functional default on (opt-out); Analytics and Marketing default off (opt-in). See also privacy-policy.md Section 22.

Document control

Table of contents

• 1. Introduction and scope
• 2. Who this policy applies to
• 3. What cookies and similar technologies are
• 4. How we use cookies — overview by category
• 5. Default settings and your choices
• 6. Cookie Preference Center (Account Settings)
• 7. Marketing-site cookie banner
• 8. Legal bases for processing
• 9. First-party cookie inventory
• 10. Third-party services overview
• 11. Stripe
• 12. Firebase and Google Cloud
• 13. Sentry
• 14. Cloudflare Turnstile
• 15. SendGrid
• 16. Google Analytics 4
• 17. Affiliate and campaign attribution
• 18. Smart TV and public surfaces
• 19. Local storage and related APIs
• 20. Browser controls
• 21. Do Not Track and Global Privacy Control
• 22. United States notices
• 23. EEA, UK, and Switzerland (future)
• 24. Other regions
• 25. Children
• 26. Security uses
• 27. Retention
• 28. Changes to this policy
• 29. Contact
• 30. Definitions
• Appendix A — Master cookie register
• Appendix B — Change log
• Appendix C — Counsel checklist
• Appendix D — Engineering notes
• Appendix E — FAQ

1. Introduction and scope

This Cookies Policy explains how 3rdSpace, Inc. uses cookies, pixels, tags, local storage, session storage, IndexedDB, and similar technologies (together, "cookies" or "cookie technologies") on:

1. the marketing website at https://the3rd-space.com;
2. the host platform (authenticated SaaS for organizations, brands, and locations);
3. public tools (contact form, Smart TV pairing at /tv/, demo/sales mode, future lead forms); and
4. the future consumer app (policy will be updated before release).

Read this together with our Privacy Policy and Terms of Service. If there is a conflict between a summary in the marketing banner and this policy, this policy controls.

Illustrative tables. Cookie names and durations marked (illustrative until production cookie audit) are placeholders until engineering completes a live-environment audit with counsel.

2. Who this policy applies to

3rdSpace operates a dual-sided platform: a B2B host platform (current focus) and a future B2C consumer app. Cookie practices may differ slightly between surfaces; we will segment disclosures in the consumer app privacy label and update this policy before app store submission.

This policy applies to:

Roles and billing. Users with Owner or Admin roles manage billing (Stripe) and may encounter additional essential cookies during Checkout. Managers and Employees use the same Preference Center for their own account.

Host customers' end consumers. Data about your customers may be processed in your CRM and tools; cookies on websites you publish through Website Services are your responsibility to disclose. This policy covers 3rdSpace-operated domains and embeds we control.

3. What cookies and similar technologies are

A cookie is a small text file stored on your computer or mobile device when you visit a site. First-party cookies are set by the3rd-space.com. Third-party cookies are set by another domain (for example stripe.com, google.com, sentry.io, cloudflare.com).

We also use:

• Local Storage — persists until cleared; used for UI state and consent mirrors;
• Session Storage — cleared when the tab closes;
• IndexedDB — structured client storage for offline-capable features (limited at launch);
• Pixels / beacons — 1×1 images or scripts recording opens/clicks (SendGrid, future ads);
• SDK identifiers — mobile advertising IDs in the future app (disclosed in app store privacy labels).

4. How we use cookies — overview by category

4.1 Essential (strictly necessary) — always on

You cannot disable essential cookies in the Cookie Preference Center. They support:

• Firebase Authentication sessions and token refresh;
• CSRF and session fixation protections;
• active organization / brand / location context in the dashboard;
• Stripe Checkout, billing portal embeds, and fraud signals;
• Cloudflare Turnstile on /contact, demo email gates, and rate-limited endpoints;
• 3rdspace_cookie_consent_v1 and signed-in consent records (to avoid repeated prompts);
• Smart TV device pairing identifiers on /tv/;
• invite-code and abuse-prevention rate limiting.

4.2 Functional — default ON, opt-out available

Functional cookies remember non-critical preferences:

• light/dark theme (also stored on your user profile in Firestore);
• first day of week for calendars;
• collapsed sidebar, table column widths, recently viewed lists;
• dismissed product tours and changelog modals.

4.3 Analytics — default OFF, opt-in required

Analytics cookies measure aggregated product and marketing performance. Default: off until you opt in via Account Settings or a future granular banner. Planned vendor: Google Analytics 4 on the marketing site post-consent. In-app analytics may use first-party event logs without third-party ad cookies unless you opt in.

4.4 Marketing — default OFF, opt-in required

Marketing cookies attribute visits to campaigns:

• UTM parameters from Email System / SMS / Campaign Manager links;
• QR Code Generator and short-link slugs;
• Affiliate Marketing L1 cookie window attribution;
• future conversion pixels (none enabled at US launch by default).

Marketing cookies do not equal marketing email/SMS consent (separate checkbox at sign-up).

5. Default settings and your choices

We do not pre-check analytics or marketing toggles. Essential cookies remain active if you opt out of all optional categories.

6. Cookie Preference Center (Account Settings)

Path: Account → Settings → Privacy → Cookie preferences

Features:

1. Toggles: Functional, Analytics, Marketing (Essential read-only).
2. Links to /cookies and /privacy.
3. Save → writes cookiePreferences on your user document + updates client script guards.
4. Shows policy version DRAFT-1 and timestamp.
5. Reset to defaults: Functional on; Analytics off; Marketing off.

Withdrawing consent stops new non-essential writes; clear browser data to remove existing third-party cookies.

7. Marketing-site cookie banner

US-friendly first-visit banner (Q-P1-28):

We use cookies to improve your experience. [Got it] · [Privacy policy]

• Sets 3rdspace_cookie_consent_v1 (planned 12 months).
• Got it ≠ analytics/marketing opt-in.
• Essential + Turnstile still load for protected forms.
• Upgrade to geo-gated UI if ≥5% EEA/UK traffic (Section 23).

8. Legal bases for processing

9. First-party cookie inventory

Verified names will replace illustrative rows after audit.

10. Third-party services overview

*Sentry replay sampling classified per final counsel review.

11. Stripe

Provider: Stripe, Inc..

Table: illustrative until production cookie audit.

12. Firebase and Google Cloud

Provider: Google LLC.

Table: illustrative until production cookie audit.

13. Sentry

Provider: Functional Software, Inc. (Sentry).

Table: illustrative until production cookie audit.

14. Cloudflare Turnstile

Provider: Cloudflare, Inc..

Table: illustrative until production cookie audit.

15. SendGrid

Provider: Twilio SendGrid.

Table: illustrative until production cookie audit.

16. Google Analytics 4

Provider: Google LLC.

Table: illustrative until production cookie audit.

17. Affiliate and campaign attribution

Affiliate Marketing L1 uses a first-party cookie plus UTM/slug encoding to attribute conversions within a configurable window (default 30 days planned). Campaign Manager, QR tools, and Email/SMS links preserve UTM parameters. These cookies fall under the Marketing category and require opt-in.

18. Smart TV and public surfaces

The /tv/ playback client sets a device cookie on first load when unpaired, enabling pairing codes and schedule sync. Classified Essential for that feature. Demo/sales mode uses isolated demo_session cookies with no real PII in seed data.

19. Local storage and related APIs

Besides HTTP cookies, we may store:

• consent mirrors (localStorage.cookiePreferences — illustrative key);
• draft form autosave (tool-specific);
• offline queue for failed writes (future).

Clearing site data in the browser removes these alongside cookies.

20. Browser controls

All major browsers let you block or delete cookies. Instructions:

Blocking essential cookies for the3rd-space.com may prevent login and payment.

21. Do Not Track and Global Privacy Control

Do Not Track (DNT): Browsers may send a DNT header. There is no industry-wide standard for how sites must respond. 3rdSpace does not treat DNT alone as a global opt-out of analytics or marketing cookies. Use the Cookie Preference Center or marketing-site flows instead.

Global Privacy Control (GPC): Where state law requires honoring GPC as an opt-out of sale/sharing, we will implement as described in the Privacy Policy. US launch relies on opt-in for analytics/marketing cookies regardless of GPC unless counsel directs otherwise.

22. United States notices

Launch scope: US-hosted businesses, USD, English UI. State laws (California CPRA, Colorado CPA, Connecticut CTDPA, Virginia VCDPA, Utah UCPA, and others) may grant rights to access, delete, and opt out of certain processing.

• Sale / sharing: We do not sell personal information as defined in our Privacy Policy.
• Sensitive data: We do not use cookies to collect sensitive categories intentionally.
• Opt-out: Analytics and marketing cookies are off by default; opt in via Preference Center.
• Authorized agents: Contact privacy@the3rd-space.com with proof of authorization.

23. EEA, UK, and Switzerland (future)

Not active at US launch. When we expand or EU/UK traffic exceeds thresholds:

1. Deploy granular consent (Reject all / Accept all / Customize).
2. Map categories to ePrivacy + GDPR standards.
3. Maintain Records of Processing Activities for cookie vendors.
4. Execute DPAs with Stripe, Google, Cloudflare, Sentry, SendGrid.
5. Honor withdrawal of consent as quickly as technical feasibility allows.

24. Other regions

Visitors outside the US and future EU markets receive US-default cookie behavior until we publish region-specific notices.

25. Children

Not directed to children under 13. Birthday gating at sign-up. Do not opt children into marketing cookies.

26. Security uses

Essential cookies support CSRF, Turnstile, session binding, Stripe Radar, and rate limits per CONTEXT Q-CR-20 and Q-CR-33.

27. Retention

Cookie lifetimes match tables above. Consent records retained while account is active + legal limitation periods. Aggregated analytics may be retained indefinitely after de-identification.

28. Changes to this policy

Material changes communicated at least 30 days before effect via in-app banner and email. Continued use after notice constitutes acceptance unless you object in writing per Terms (Q-CR-25). Version history in Appendix B.

29. Contact

• Email: privacy@the3rd-space.com (TBD before launch)
• Privacy requests: Account → Settings → Privacy
• Mail: 3rdSpace, Inc., [address TBD]

30. Definitions

Cookie — Small text file placed by a site or embed.

Essential — Strictly necessary to provide the service you request.

Functional — Preferences that improve UX but are not strictly necessary.

Analytics — Measurement of usage in aggregate.

Marketing — Attribution and campaign effectiveness.

Preference Center — Account → Settings → Privacy → Cookie preferences.

Illustrative row — Placeholder until production cookie audit confirms name and duration.

Appendix A — Master illustrative cookie register

A.1 3rdSpace first-party

A.2 Stripe

A.3 Firebase / Google

A.4 Sentry

A.5 Cloudflare Turnstile

A.6 SendGrid

A.7 GA4

Appendix B — Change log (draft)

Appendix C — Counsel review checklist

1. Essential vs functional split valid under ePrivacy (future EU).
2. GA4 loads only post-consent; Consent Mode v2 defaults denied.
3. Stripe cookie list matches Checkout + Customer Portal + Connect flows.
4. Sentry replay disclosure matches production sample rate and masking.
5. Turnstile listed as subprocessor; data processing terms referenced.
6. Affiliate cookie duration matches tool spec (30-day default).
7. Smart TV cookie scoped essential for /tv/ only.
8. Banner text not deceptive; Got it does not imply analytics opt-in.
9. Preference Center satisfies CPRA opt-out timing.
10. Host-published sites disclaimer — host responsibility for extra cookies.
11. No pre-checked analytics/marketing anywhere.
12. 30-day notice aligns with constructive continuation (Q-CR-25).
13. Contact email and postal address finalized.
14. Relationship to Privacy Policy Section 7 (service providers).
15. SendGrid email pixels distinguished from site cookies.
16. Demo mode cookies cannot cross into production tenant.
17. Internal tier org-3rdspace uses same consent UX.
18. Cookie policy version stored in acceptance ledger with ToS/Privacy.
19. MDX publication at /cookies matches repo version.
20. Cross-border transfer language consistent with DPA stub.

Appendix D — Product engineering mapping notes

D.1 Consent storage

Firestore users/{uid}.cookiePreferences + 3rdspace_cookie_consent_v1 for anonymous.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.2 Script gating

GA4 and marketing tags wrapped in consent guard; essential SDKs load unconditionally.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.3 Single domain

the3rd-space.com only at launch — cookie scope covers /dashboard and marketing routes.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.4 HttpOnly session

Session cookies must be HttpOnly + Secure + SameSite=Lax minimum.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.5 Turnstile endpoints

/contact, demo email gate, invite join — per Q-CR-20.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.6 Rate limits

Contact 5/hr/IP + 3/hr/email hash — cookies not used for quota (server-side).

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.7 Affiliate L1

Marketing category; 30-day window; slug + cookie dual attribution.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.8 Affiliate L2

Server-side attribution may reduce marketing cookie reliance.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.9 Smart TV

tv_device_id essential; no analytics on playback page by default.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.10 Stripe Portal

Third-party iframe cookies during payment-method update only.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.11 Firebase Auth

Essential; 1-hour email verification links separate from cookies.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.12 Theme preference

Functional cookie + Firestore profile field — opt-out stops cookie mirror.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.13 Export job

Privacy export uses signed GCS URL — no tracking cookies in email link.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.14 Sentry PII

Scrubbing rules before production; replay off unless counsel approves.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.15 GA4 env var

Tracking ID in env; disabled in dev/staging without explicit flag.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.16 EU geo gate

Cloudflare or analytics geo signal triggers banner variant ≥5% EU traffic.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.17 GPC handler

Future middleware hook on marketing site.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.18 Cookie audit CI

Optional automated scan in release pipeline.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.19 Version bump

DRAFT-1 → publish increments cookiesPolicyVersion.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

D.20 AUP cross-link

Abuse prevention cookies referenced in Acceptable Use Policy.

Test plan: Verify in staging with devtools Application tab and network filter before prod.

Appendix E — Frequently asked questions

E.1 Why can't I disable essential cookies?

Answer: They are required for login, security, billing, and abuse prevention.

E.2 Does Got it enable Google Analytics?

Answer: No. Analytics requires a separate opt-in.

E.3 Are functional cookies shared with advertisers?

Answer: No.

E.4 Does marketing cookie opt-in subscribe me to email?

Answer: No — separate marketing consent.

E.5 How do I delete cookies?

Answer: Browser clear-site-data for the3rd-space.com or sign out for session cookies.

E.6 What if I block all cookies?

Answer: You may not be able to sign in, pay, or submit contact/demo forms.

E.7 Does Stripe set third-party cookies?

Answer: Yes during Checkout/Portal; see Section 11.

E.8 Is Sentry session replay on?

Answer: Only if enabled in production config; default planning is minimal.

E.9 GA4 inside the dashboard?

Answer: Planned for marketing site first; in-app uses first-party unless you opt into analytics cookies involving Google.

E.10 How long is consent stored?

Answer: 12 months for banner cookie; account preferences until you change them.

E.11 Affiliate cookies — PII?

Answer: Pseudonymous IDs for attribution, not direct identity.

E.12 Turnstile on contact form?

Answer: Yes — essential bot protection.

E.13 SendGrid website cookies?

Answer: Generally none; email pixels are separate.

E.14 Host customer websites?

Answer: Hosts disclose their own cookies on sites they publish.

E.15 Do Not Track?

Answer: We do not uniformly honor DNT; use Preference Center.

E.16 Global Privacy Control?

Answer: Honored where legally required; US launch uses opt-in defaults.

E.17 EU visitor before EU launch?

Answer: US defaults apply; geo UI if traffic threshold met.

E.18 Policy change notice?

Answer: 30 days for material changes.

E.19 Who to contact?

Answer: privacy@the3rd-space.com (TBD).

E.20 Where is signed-in consent stored?

Answer: User profile in Firestore.

E.21 Can Admins change my cookie choices?

Answer: No — per-user preference.

E.22 Org-level cookie policy?

Answer: No — consent is per user account.

E.23 Demo mode tracking?

Answer: Isolated session; no production analytics.

E.24 Smart TV analytics?

Answer: Off by default on /tv/.

E.25 QR scan cookies?

Answer: Marketing category when tracking campaigns.

E.26 Internal staff accounts?

Answer: Same Preference Center UX.

E.27 Mobile app cookies?

Answer: Updated policy before app store release.

E.28 Cross-device sync?

Answer: Preferences sync via account when signed in.

E.29 Incognito mode?

Answer: Cookies cleared when window closes; consent re-prompted.

E.30 Shared computer?

Answer: Sign out after use; clear cookies if needed.

E.31 Billing without marketing cookies?

Answer: Yes — Stripe essential cookies only during payment.

E.32 Withdraw consent effect?

Answer: Stops new non-essential cookies; clear browser for old ones.

E.33 Children?

Answer: Service not for under-13; do not enable marketing cookies for minors.

E.34 California rights?

Answer: See Section 22 and Privacy Policy.

E.35 Cookie policy version?

Answer: DRAFT-1 dated 2026-05-19.

E.36 Illustrative table rows?

Answer: Replaced after production cookie audit.

E.37 Twilio SMS cookies?

Answer: SMS does not set site cookies; links may carry UTM.

E.38 Cloudflare CDN?

Answer: Turnstile only at launch; full CDN cookies TBD if enabled.

E.39 IndexedDB?

Answer: Limited use; disclosed in Section 19.

E.40 Session replay privacy?

Answer: Sentry masks inputs per configuration.

E.41 Future ad pixels?

Answer: Would require marketing opt-in and policy update.

22.1 State-specific reference (non-exhaustive)

California: CPRA — right to opt out of sale/share; analytics/marketing cookies off by default.

Colorado: CPA — universal opt-out mechanisms; GPC consideration.

Connecticut: CTDPA — similar opt-out rights.

Virginia: VCDPA — data protection assessments for high-risk processing.

Utah: UCPA — business-friendly notice standard.

Texas: TDPSA — applies to certain processors; review at scale.

Oregon: OCPA — effective 2024; consent for sensitive data.

Montana: MCDPA — consumer opt-out rights.

Delaware: DPDPA — 2025 effective; harmonize notices.

New Jersey: DPL — 2025; align with CPRA-style rights.

23.1 Future GDPR / ePrivacy implementation checklist

1. Prior consent before non-essential cookies (except strictly necessary).
2. Equal prominence Accept / Reject / Customize.
3. No cookie walls denying service for refusing analytics.
4. Record consent timestamp, version, and channel.
5. Data Processing Agreements with all subprocessors setting cookies.
6. Transfer mechanisms (SCCs) for US-hosted processors.
7. Cookie policy in local languages when UI localized.
8. ICO / CNIL guidance on analytics cookies (legitimate interest vs consent — counsel decides).
9. Right to erasure includes consent logs where not legally required to retain.

Version: DRAFT-1
Last updated (draft): 2026-05-19
Last reviewed by counsel: never (not yet)
Anchored to product features as of: 2026-05-19