Cookie policy
Last updated 11 November 2026
Draft: this document describes how Kithwork actually works, but it hasn't yet been reviewed by a solicitor. It will be before Kithwork leaves beta.
The short version
Kithwork only sets cookies that are strictly necessary to sign you in and keep your account secure. We don't use advertising, analytics or tracking cookies, and nothing on our site lets another company track you. Because these cookies are essential, the law (the Privacy and Electronic Communications Regulations) doesn't require us to ask for consent, so you won't see a cookie banner.
The cookies we set
On the live site the names start with __Secure-, which means browsers only send them over HTTPS. They're all marked HttpOnly, so scripts on the page can't read them.
| Name | What it does | How long |
|---|---|---|
| better-auth.session_token | Keeps you signed in. Holds a random session reference, signed so it can't be forged. | 30 days, extended while you use Kithwork |
| better-auth.two_factor | Remembers that you've entered your password while you enter your two-step code. | A few minutes |
| better-auth.trust_device | Only if you tick “Trust this browser”: skips the two-step code on this browser. | 30 days |
Payments
When you upgrade, you're taken to Stripe's checkout and billing pages. Stripe sets its own cookies there to process the payment and prevent fraud; its cookie policy at stripe.com explains them. Kithwork's own pages don't load Stripe.
Controlling cookies
You can block or delete cookies in your browser settings. If you block the cookies above you won't be able to sign in.
Changes
If we ever want to add a cookie that isn't strictly necessary, we'll update this page and ask for your consent first. Questions? Contact us at the contact address shown in the app. See also our privacy policy.