This policy explains what Brymio (www.brymio.com) stores in your browser and what for. The list is deliberately short: the public site barely needs anything and the application stores what it takes to keep you signed in plus a few of your preferences.
Cookies and local storage
Cookies are small files a site stores in your browser. Brymio also uses the browser's storage (localStorage and sessionStorage, plus IndexedDB in Projects), which works the same way from your point of view: data that stays on your device. We list it all so nothing is left out.
What we store
Essential
Without these the application does not work, so they cannot be declined. They are not used to track you and are not shared with anyone.
- Session (the authjs.session-token cookie — __Secure-authjs.session-token over HTTPS —, authjs.callback-url, the CSRF protection cookie and, while you sign in with Google, authjs.pkce.code_verifier and authjs.state): these keep you signed in while you use the application. The session cookie lasts up to seven days and disappears when you sign out.
- Sign-in and connections (the brymio_team_google, brymio_wa_challenge and shopify_oauth_nonce cookies): they last five to ten minutes and only appear while an employee signs in with Google or a passkey, or while you connect a Shopify store. They check that the response belongs to the request you started. When you create an account, the brymio_signup cookie keeps for up to seven days the proof that this browser chose the password, and it is removed when you confirm your email.
- Cookie decision (ks-cookie-consent in local storage): remembers whether you accepted everything or only the essentials, so we do not ask you again.
- Theme (ks-theme in local storage): remembers whether you prefer light or dark mode.
- Kiosk (the brymio_kiosk cookie): only on the tablets or computers a company sets up as a shared punch point. It identifies the device, not the person, and lasts a year.
- Quick audit (the brym_free_audit cookie): only if you run the free website analysis without signing up. It limits the number of free analyses per visitor and lasts 30 days.
- Public invoice (bif_… cookie): only if you open an invoice from its link and enter the code we send you. It remembers that device for 30 days so we do not ask for the code again.
- Job posts and the candidate portal (brymio.com/jobs/… and the link each applicant receives): viewing a post or applying sets no cookie of ours and loads no analytics. The job listing on the public website (brymio.com/en/jobs) is different: it measures visits with Vercel Analytics, without cookies, and only loads Google Analytics if you accept it. If you enter in the portal the code we email you, we store a bcp_… cookie for 30 days so we do not ask for it again on that device; it is only sent to the portal pages and you can remove it with “Don't remember this device”. The application form, like the sign-up form, loads Cloudflare Turnstile's bot check, which may use technical data from your browser for that check and nothing else.
Analytics
These tell us what gets used and what breaks. Google Analytics and HeyCatch only measure if you accept analytics cookies in the banner, and only on the public site; if you choose "essential only", they never measure at all.
- Google Analytics 4 (_ga, _ga_*): pages viewed, visit duration and traffic source, without identifying you. Processed by Google LLC. Only with your consent.
- HeyCatch (cookie and localStorage ph_phc_…_posthog, which last a year, and localStorage heycatch_session_volume): pages viewed, clicks and traffic source on the public site, with a random identifier and without identifying you. Processed by HeyCatch, Inc. (United States). Only with your consent. If you choose "essential only" or withdraw your consent, localStorage __ph_opt_in_out_phc_… stores that decision so it does not measure.
- Vercel Analytics and Speed Insights: aggregate measurement of visits and loading speed. They use no cookies, store nothing in your browser and do not identify the visitor, which is why they are always on.
Functional
These improve the experience without being essential:
- Language (the NEXT_LOCALE cookie): remembers which language you want Brymio in, so you are not sent back to your browser's language on every visit.
- Store search on the merchant's shop (sessionStorage brymio_search_sid and brymio_search_recent): a random identifier so that one visit counts as one even if it searches several times, and your latest searches, to offer them again. They are not cookies and they disappear when you close the tab. Recent searches never leave your browser; the identifier travels with the search clicks and we store it only as a fingerprint that cannot identify you.
- Welcome offer (localStorage brymio-welcome, plus sessionStorage brymio-welcome-t0 and brymio-welcome-views during the visit): remembers whether you already saw, closed or used the public website's subscription window, so it is not shown again, and how long you have been on the site, so it is not shown the moment you arrive. It is not a cookie and it never leaves your browser.
- App preferences (localStorage, with keys such as brymio-page-width, ks-store-health-view or brymio-projects-pomodoro-state, and the pm_last_page_… and brymio_sidebar cookies): they remember how you left each screen, such as a page's width, the columns of the product table, collapsed summaries or the pomodoro timer. pm_last_page_… keeps the last page you opened in Projects for 180 days, to take you back to it, and brymio_sidebar remembers for a year whether you collapsed the sidebar. On the device where an employee clocks in, brymio_team_org remembers their company to take them to its sign-in page.
- Work in progress (IndexedDB and sessionStorage): Projects keeps the changes you make offline in the browser until it can send them; the PIN of a secure note is remembered while the tab is open, so you are not asked for it at every step; when you add someone hired in Hiring to Team, their name and email pass from one screen to the next and are deleted once used; and in Hiring, while the tab is open, the applications you are reviewing and the ones you have ticked are remembered (only their identifiers).
- Help assistant (sessionStorage brymio.support.chat.v1): keeps your conversation with the assistant in the help bubble so it is not lost when you change page. It is not a cookie and it disappears when you close the tab; what you ask is sent to answer you, as the privacy policy explains.
Managing your preferences
The first time you arrive, a banner lets you accept all cookies or keep only the essential ones. You can change your mind by clearing this site's data in your browser: next time you visit, the banner will ask again.
From your browser
Every browser lets you inspect and delete cookies and local storage from its privacy or security settings. If you block everything, the public site will still display, but you will not be able to sign in to the application.
Changes to this policy
We may update this policy if our practices or the tools we use change. The date at the top shows the latest revision.
Contact
For any question about what we store in your browser, write to info@krokanti.com.