Last updated: 2026-10-02 · v2026-10-02
Cookie Policy
This Cookie Policy explains what cookies and similar technologies are, which ones Sinapti uses (available at https://app.sinapti.com), for what purpose, and how you can accept, reject and withdraw your consent at any time.
This policy has been prepared following the Guidance on the use of cookies issued by the Spanish Data Protection Agency (AEPD), in the version updated in May 2024, and the layered-information model.
What are cookies?
A cookie is a small text file that a website stores in your browser or device when you visit it. It allows the site to remember information about your visit, such as your login session or your preferences.
Alongside cookies, Sinapti uses other browser storage technologies that serve equivalent functions and which, for the purposes of this policy and of applicable law, receive the same treatment as cookies:
localStorage: stores small configuration values (for example, your theme preference or interface state) persistently in your browser.IndexedDB: a browser database that Sinapti uses to keep a copy of the documents you edit and of what you create while offline, until it is synchronised.- Service worker cache: a copy of recent pages and responses that lets Sinapti load faster and open while offline.
Throughout this policy, the term "cookies" covers both cookies in the strict sense and these similar technologies.
Types of cookies by purpose
Technical or essential cookies (no consent required)
These are indispensable for the application to work and to provide the service you expressly request when you register, sign in and use Sinapti. They do not require your consent and cannot be disabled, because without them the service cannot be provided. They include:
- Authentication and session: keep your session securely logged in, protect forms against cross-site request forgery (CSRF) attacks and support two-step verification and the Google Calendar connection. Managed by the authentication system (NextAuth/Auth.js) and by the application itself.
- Cookie-consent record (
sinapti_consent_id): a technical cookie that links your decision about cookies to an identifier, so that we can demonstrate your consent or refusal (an obligation under data-protection law itself). - Theme and language preference: remember the appearance (light/dark/system) and language you have chosen. As they reflect an express user choice, they are considered technical under the AEPD Guidance.
- Interface state: remember display settings such as the sidebar state, applied filters, or notices you have already dismissed.
- Offline storage (Yjs / IndexedDB and the service worker cache): keeps a copy of the documents you edit and of what you create while offline, so you can keep working and do not lose changes.
Analytics cookies (consent required)
They allow us to measure how the application performs (performance, errors, user-experience metrics) in order to improve it. They are only activated if you give your consent. If you do not, they are not loaded.
- OpenObserve RUM (Real User Monitoring): a user-experience analytics solution self-hosted by Sinapti (no data is shared with third parties). The analytics session is linked to an identifier of your account. It records the pages you visit, errors and clicks, but masks the text of the elements you click, so it does not collect the content of your notes. It does not perform session replay.
Marketing or advertising cookies (consent required)
These would be used to display personalised advertising or to measure campaigns. Sinapti currently does not use any cookie in this category. We keep this section for information purposes in case any are added in the future, in which case your prior consent would be requested and this policy would be updated.
Detailed table of cookies and storage
| Name | Type / Purpose | Category | Duration | Ownership |
|---|---|---|---|---|
authjs.session-token / __Secure-authjs.session-token | Maintains the authenticated user session (JWT token) | Technical / essential | 30 days or until you sign out | First-party |
authjs.csrf-token / __Host-authjs.csrf-token | Protection against CSRF attacks on forms and actions | Technical / essential | Session | First-party |
authjs.callback-url / __Secure-authjs.callback-url | Handles redirection after sign-in | Technical / essential | Session | First-party |
authjs.pkce.code_verifier, authjs.state, authjs.nonce | Security of Google sign-in (OAuth/PKCE) | Technical / essential | 15 minutes (during sign-in) | First-party |
sinapti-2fa / __Host-sinapti-2fa | Supports two-step verification while you enter the code | Technical / essential | 10 minutes | First-party |
calendar_oauth_state | Security of the Google Calendar connection | Technical / essential | 10 minutes (while connecting) | First-party |
sinapti_consent_id | Pseudonymous identifier that links and evidences your cookie decision (consent record). Only created if you decide without being signed in, and linked to your account if you sign in afterwards | Technical / essential | 13 months | First-party |
locale | Remembers the language chosen in your profile. Only exists if you have changed it | Technical / essential (user choice) | 12 months | First-party |
sinapti-theme (localStorage) | Remembers the theme preference (light/dark/system) | Technical / essential (user choice) | Persistent until cleared | First-party |
sinapti_cookie_consent (localStorage) | Stores your cookie decision in the browser so the banner is not shown again while it remains valid | Technical / essential | Up to 13 months / until cleared | First-party |
sinapti-sidebar-collapsed, sinapti-global-tags, sinapti-resources-tree, calendar-prefs, sinapti-dismissals (localStorage) | Remember interface settings: sidebar, filters, Resources tree, calendar view and dismissed notices | Technical / essential (user choice) | Persistent until cleared | First-party |
yjs-<type>-<id> (IndexedDB) | Local copy of each document you edit, to work offline and not lose changes | Technical / functional | Persistent until cleared | First-party |
sinapti-offline (IndexedDB) | Queue of what you create while offline, until it is synchronised | Technical / functional | Until synchronised | First-party |
| Service worker cache | Copy of recent pages and responses to load faster and open Sinapti offline | Technical / functional | Data and pages, 24 hours; images and guide figures, 30 days; fonts, 7 days; application files, until the next release | First-party |
RUM SDK session cookie (OpenObserve) _oo_s_v2 (the previous one, _oo_s, may remain in your browser until it expires) | Identifies the analytics session and, for one year, the device | Analytics | 1 year (the analytics session it carries expires after 15 minutes of inactivity) | First-party (self-hosted) |
The authentication cookies carry the
__Secure-/__Host-prefix and thesecureattribute only in the production environment (HTTPS). Exact names may vary slightly depending on the version of the authentication library.
Legal basis
- Technical or essential cookies: their use relies on the exemption in Article 22.2 of the LSSI (Spanish Law 34/2002), as they are strictly necessary to provide the service expressly requested by the user. They do not require consent.
- Analytics and, where applicable, marketing cookies: the legal basis is your consent (Art. 22.2 LSSI and the General Data Protection Regulation – GDPR). You may freely grant or deny it, and withdraw it at any time without this affecting the essential functioning of the application.
How to accept, reject and withdraw consent
When you first access the application, Sinapti shows a cookie banner with clear information about its use. In that banner:
- You can Accept all cookies.
- You can choose Essential only to reject every non-essential cookie. Rejecting is as easy as accepting: both options are at the same level, with equal visibility, and neither is highlighted over the other.
- You can click Configure to decide granularly, per purpose (for example, to accept analytics but not other categories).
Until you make a decision, no non-essential cookie is installed.
To change your decision later, open Settings → Account in the application and click Cookie preferences in the Cookies section: the panel opens again, where you can review and modify your choices or fully withdraw your consent. If you are not signed in, the same link is available in the footer of the sign-in and sign-up screens.
In addition, you can manage or delete cookies from your browser settings (Chrome, Firefox, Safari, Edge, etc.), as well as clear local storage (localStorage / IndexedDB). Please note that deleting technical cookies may prevent the application from working correctly (for example, by signing you out).
International transfers
The analytics cookies used by Sinapti rely on OpenObserve RUM, self-hosted by Sinapti on infrastructure located in the European Union (OVHcloud). Therefore, the use of cookies does not involve international transfers of data to third countries.
If third-party cookies entailing international transfers were added in the future, this would be expressly stated in this policy and, where applicable, the corresponding consent would be obtained with the safeguards required by the GDPR.
Retention of consent
Your cookie decision is retained for a maximum of 13 months, in line with the AEPD recommendation. Once that period elapses (recorded internally via an expiry date, expiresAt), or when this policy changes materially (controlled via a policy version), we will request your consent again by showing the banner once more.
Your consent will also be requested again if you clear your browser storage.
Changes to the cookie policy
We may update this Cookie Policy to reflect changes in the cookies we use, in the technology employed, or in applicable law. When changes are material, we will notify you by showing the banner again to obtain your consent anew. We recommend that you review this page periodically; the last-updated date and the current version appear in the header of this document.