Loading…
Effective date: August 6, 2026
This Cookie Policy explains how Doclator ("we", "us", "our") uses cookies and similar storage technologies on doclator.com and related domains. It should be read together with our Privacy Policy.
By continuing to use the Service, you consent to the use of cookies and storage technologies as described below. You can withdraw consent at any time by clearing your browser storage or by using the controls described in Section 6.
Cookies are small text files placed on your device by a website. They help the website remember information about your visit, such as your preferred language and login state, so subsequent visits are faster and more useful.
Local storage and session storage are similar mechanisms built into modern browsers that allow a website to store small amounts of data on your device. Doclator uses local storage instead of cookies to hold authentication tokens, because it provides better cross-origin behavior for our API.
We refer to all of these technologies collectively as "cookies" throughout this policy unless we need to be specific.
We use cookies and similar storage to:
We do not use cookies for advertising, retargeting, or building marketing profiles. We do not sell or share cookie-derived data with advertising networks.
Required for the Service to function. They cannot be disabled without breaking core functionality.
| Name | Purpose | Storage | Duration |
|---|---|---|---|
| access_token | JWT used to authenticate API calls | Local storage | Up to 7 days |
| refresh_token | Opaque token to silently rotate the access token | Local storage | Up to 30 days |
Remember your preferences so the Service feels personalized.
| Name | Purpose | Storage | Duration |
|---|---|---|---|
| theme | Light, dark, or system theme preference | Local storage | Persistent until cleared |
| NEXT_LOCALE | Selected interface language | Cookie | 1 year |
| doclator_referral | Referral code used to attribute an eligible new account | Cookie | 30 days or until registration |
| doclator_partner_click | Opaque click token used to attribute an eligible new account to a Partner campaign | HTTP-only cookie | Partner policy window, up to 90 days, or until registration |
Used to detect bots, enforce rate limits, and protect against fraud.
| Source | Purpose | Duration |
|---|---|---|
| Cloudflare | DDoS protection, request routing, and server-side rate limiting | Up to 24 hours |
Help us understand how the Service is used in aggregate.
| Provider | Purpose | Duration |
|---|---|---|
| Cloudflare Workers Observability | Aggregate request metrics and operational logs | According to our infrastructure retention setting |
Capture errors so we can debug and fix them quickly.
| Provider | Purpose | Duration |
|---|---|---|
| Sentry | Crash reports, stack traces, slow-transaction tracing | 90 days |
Some pages of the Service include third-party features that may set their own cookies:
We have no control over third-party cookies. Please consult each provider's policy: Stripe, Lemon Squeezy, Paddle, Google, Microsoft.
The access_token is mirrored to an HTTP-only cookie for server-side and WebSocket authentication and is also stored locally for API Authorization headers. The opaque refresh_tokenis stored locally and rotated after use. We mitigate browser-storage risk through a strict Content Security Policy, React output escaping, token rotation, and server-side session revocation.
You can control cookies and local storage in several ways:
Disabling strictly necessary cookies will break sign-in, file uploads, and other core features.
We may update this Cookie Policy from time to time to reflect new features or regulatory guidance. Material changes will be flagged in this page's effective date and, where required, by an in-app notice. Continued use of the Service after the updated effective date constitutes acceptance of the revised policy.
Questions about cookies or storage? Email us at privacy@doclator.com.
Last updated: August 6, 2026