Skip to main content

Cookie Policy

Last Updated: June 6, 2026

This Cookie Policy explains the cookies and browser storage SyncHOA uses. Our Privacy Policy explains broader data collection and use.

1. Summary

SyncHOA does not use advertising cookies, retargeting pixels, heatmaps, session replay, Google Analytics, Tag Manager, or behavioral tracking scripts. We use only the storage necessary for authentication, payment processing, security, and user preferences. Because we use only strictly necessary and functional storage, no cookie consent banner is currently shown. If we ever add optional analytics or tracking, this policy will be updated and a consent mechanism will be provided before any optional scripts load.

2. Authentication Cookies (Auth.js / NextAuth)

Auth.js (NextAuth v5) sets the following cookies when you sign in. These are strictly necessary — without them, authenticated pages cannot load. Disabling these cookies will prevent sign-in from working.

  • authjs.session-token— encrypted session identifier. Expires after 30 days of inactivity. HttpOnly, Secure, SameSite=Lax.
  • authjs.csrf-token— CSRF protection token for form submissions. Expires at end of browser session (cleared on browser close).
  • authjs.callback-url— stores the post-login redirect URL. Expires at end of browser session.
  • __Secure- prefix variants— in production (HTTPS), the above cookies are prefixed with __Secure- for additional security.

3. Stripe Cookies

When you subscribe to a paid plan or use resident payment features, Stripe may set the following cookies for fraud detection and payment processing. These are set and controlled by Stripe, not SyncHOA.

  • __stripe_sid— Stripe session identifier. Expires at end of browser session.
  • __stripe_mid— Stripe machine identifier used for fraud prevention. Expires after 1 year.

For more information on Stripe's cookies, see Stripe's Privacy Policy.

4. Browser Storage (localStorage)

SyncHOA stores the following UI preference items in browser localStorage on your device. These items are never sent to our servers, are not used for tracking or advertising, and are cleared when you clear browser storage.

  • synchoa-theme— your light or dark mode preference. Persistent until cleared.
  • sidebar-collapsed— board sidebar expanded/collapsed state. Persistent until cleared.
  • synchoa-early-access-dismissed— tracks whether you dismissed the early-access announcement banner. Persistent until cleared.

5. Preference Cookies

The shadcn/ui sidebar component sets one persistent browser cookie:

  • sidebar_state— stores sidebar open/closed state. Persistent (no set expiry; remains until browser storage is cleared).

6. SessionStorage

SyncHOA uses sessionStorage for one item. SessionStorage is scoped to your browser tab and cleared automatically when the tab is closed.

  • setup-health-panel-[communityId]— tracks whether the onboarding health panel has been viewed in the current session. Cleared on tab close.

7. Do Not Track

SyncHOA does not currently respond to browser Do Not Track (DNT) signals. There is no industry standard for interpreting these signals. In any case, SyncHOA does not use behavioral tracking scripts or advertising cookies.

8. Managing Storage

You can clear cookies and browser storage at any time in your browser settings. Clearing authentication cookies will sign you out. Clearing localStorage resets your theme and sidebar preferences.

  • Chrome: Settings → Privacy and security → Clear browsing data
  • Firefox: Settings → Privacy & Security → Cookies and Site Data → Clear Data
  • Safari: Settings → Privacy → Manage Website Data
  • Edge: Settings → Privacy, search, and services → Clear browsing data

Questions: legal@synchoa.com