Cookie Policy
This Cookie Policy explains how Trooth, LLC ("Trooth," "we," "us," or "our") uses cookies and similar technologies on trooth.co (the "Website"), what each one does, and how you control them.
1. What cookies and similar technologies are
Cookies are small text files a website asks your browser to store and send back on later visits. Cookies set by the site you are visiting are first-party cookies; cookies set by anyone else are third-party cookies. Similar technologies include the storage a browser gives a site (such as localStorage) and scripts that report how a page is used. This policy covers all of them.
2. How Trooth uses them
By default, the Website uses only what it needs to work: to keep you signed in, to protect sign-in and forms from abuse, and to remember choices you make, such as your appearance and region. These are strictly necessary and are always on.
The only optional category Trooth uses is analytics, described in section 4. Trooth sets no advertising cookies and does no cross-site tracking (section 7).
In the European Economic Area, the United Kingdom and Switzerland, where the law asks for consent first, a cookie panel asks for your choice on your first visit, and nothing optional runs until you choose. "Reject all cookies" and "Accept all cookies" are the same size and take one click each, and "Customize cookie settings" lets you choose by category. If we cannot tell where you are, we treat you as being in one of those places. Everywhere else no panel appears: analytics runs by default, and you can turn it off at any time from Cookie preferences in the Website's footer.
3. The cookies Trooth sets
Every cookie below is first party: it is set by trooth.co and read only by trooth.co. None is used for advertising, and none is shared with an advertiser.
| Name | Purpose | Set | Kept for | Category |
|---|---|---|---|---|
__Host-trooth_session | Keeps you signed in. It is the credential for your session and cannot be read by the page's scripts. The __Host- prefix makes your browser accept it only over HTTPS, for trooth.co alone. Until November 30, 2026 a browser may still hold it under its earlier name, trooth_session, which is replaced on your next visit. | When you sign in | 30 days, or until you sign out | Necessary |
trooth_consent | Records the choice you made in the cookie panel, so we do not ask again and so we can honor it. | When you choose in the cookie panel, or when your browser sends a Global Privacy Control signal | 12 months | Necessary |
trooth_oauth_state_google, trooth_oauth_state_microsoft, trooth_oauth_state_github, trooth_apple_state, trooth_sso_state | Protects a sign-in with an outside provider from being forged. | When you start that sign-in | 10 minutes | Necessary |
trooth_oauth_link_google, trooth_oauth_link_microsoft, trooth_oauth_link_github, trooth_oauth_link_apple, trooth_apple_link_code | Marks a provider sign-in you started from your settings as connecting that provider to the account you are in, so it is never taken as a new sign-in. For Apple, holds the one-time code until your browser returns with your session. | When you choose Connect in your settings | 10 minutes (the Apple code, 2 minutes) | Necessary |
trooth_pk_auth_chal, trooth_pk_reg_chal | Holds the one-time challenge a passkey sign-in or registration signs. | When you use or add a passkey | 5 minutes | Necessary |
trooth_auth_return | Returns you to the page you were on after you sign in. | When a page sends you to sign in | 10 minutes | Necessary |
trooth_slack_state | Protects the Slack connection for status alerts from being forged. | When you start connecting Slack | 10 minutes | Necessary |
trooth_incognito | Keeps a buyer workspace in the private mode you turned on. | When you turn private mode on | 12 hours | Necessary |
trooth-theme | Remembers the light or dark appearance you chose. | When you choose an appearance | 12 months | Necessary (a choice you made) |
trooth-theme-variant | Remembers the high contrast or color blindness theme you chose. | When you choose one | 12 months | Necessary (a choice you made) |
trooth_region | Remembers the region you chose for privacy terms. | When you choose a region | 12 months | Necessary (a choice you made) |
trooth_announcement_dismissed | Remembers that you closed an announcement. | When you close it | 12 months | Necessary (a choice you made) |
trooth_last_method | Shows which sign-in method you used last. | When you sign in, and only if you chose Accept all cookies | 180 days | Preferences (with your consent) |
Cookies marked "a choice you made" are set only when you make that choice, and hold only that choice.
4. Analytics
Where analytics is allowed (after you agree, in the European Economic Area, the United Kingdom and Switzerland; by default elsewhere, unless you turn it off or your browser sends a Global Privacy Control signal), the Website loads two measurements:
- Vercel Web Analytics counts page visits and a small set of named events (for example, that a search was run). It sets no cookie. Vercel identifies a visit by a hash of the incoming request that it discards after 24 hours, and records the page, the referrer, an approximate location (country, region and city) and the browser and device type. See Vercel's description of Web Analytics.
- Sentry performance sampling records how long a sample of page loads take, so we can find slow pages. It sets no cookie.
If you reject or turn off analytics, neither loads and no event is sent. A change takes effect from the next event, without a reload, in every open tab.
5. Services that keep the Website working and secure
These run for everyone, because the Website cannot be operated safely without them. None is used for advertising.
- Sentry error reports. When a page fails, a report of the error is sent to Sentry so we can fix it. Reports carry no cookie, and before a report is sent we remove sign-in tokens, cookie values and other credentials from it.
- Cloudflare Turnstile. On sign-up, sign-in recovery, contact and similar forms, Turnstile checks that the form is being submitted by a person rather than a program. Cloudflare processes technical information from your browser for that purpose only. See Cloudflare's Turnstile privacy addendum. It loads only on a page that has one of those forms.
- Kyrie, the AI assistant. If you open Kyrie and send a message, what you type is sent to Cloudflare Workers AI to write the answer. Trooth keeps a count of requests for rate limiting, not the message. See the model card.
6. Local storage and other device storage
Alongside cookies, the Website uses the storage a browser makes available to a site it has loaded, principally localStorage and sessionStorage. This storage is first party: it is written by trooth.co, it can be read only by trooth.co, and unlike a cookie it is not attached to the requests your browser sends us.
We use it to hold interface state and preferences you set rather than to identify you: the appearance you chose, notices you have dismissed, the columns, filters and saved views you set on a table, the shortlist of companies you build while signed out, and a copy of your cookie choice. It stays on your device, and we do not use it for advertising or share it with advertisers.
You can clear it at any time through the same browser controls that clear cookies. We do not use Local Shared Objects (so-called Flash cookies); Adobe Flash Player reached end of life on December 31, 2020.
7. Advertising and cross-site tracking
Trooth does not run advertising, sets no advertising or social-media cookies, uses no tracking pixels, and does not sell or share personal information for cross-context behavioral advertising. No third party places cookies through the Website to follow you to other sites. If that ever changes, it will be off by default, it will appear in the cookie panel as its own choice, and this policy will say so before it runs.
8. Your choices, and Global Privacy Control
You can change or withdraw your choice at any time from Cookie preferences in the Website's footer, which reopens the cookie panel. Your choice is kept for 12 months, and we ask again when it expires or when what it covers changes.
If your browser sends a Global Privacy Control (GPC) signal, we treat it as "Reject all cookies" for that browser without asking, and analytics stays off unless you turn it on yourself. You can also block or delete cookies in your browser's settings; blocking strictly necessary cookies will stop sign-in from working.
The copy we keep. When you make a choice, your browser keeps it with a random receipt id and sends the same choice to us, so we can show later that it was made. Our copy holds the receipt id, the choice, whether a GPC signal was on, the page you were on (without any query), the time and your browser's user agent. It holds no IP address, email or account. Nothing in it changes after it is written, except that the page and the user agent are removed after 90 days, and the whole copy is deleted 24 months after the choice. To see the choices recorded for your browser, email privacy@trooth.co with the receipt id, which your browser stores in its trooth_consent record.
9. Changes to this policy
We update this policy when the cookies or technologies we use change. The date at the top shows when it last changed, and each change is recorded in a revision note at the end.
10. Contact
Questions about this policy or our use of cookies: legal@trooth.co, or by post to Trooth, LLC, 777 Brickell Ave, Suite 500, PMB 1174, Miami, FL 33131, United States.
Revision note. Revised September 27, 2026. This policy was rewritten to describe what the Website actually does. The earlier text was a general template: it said third parties might serve advertising cookies through the Website and referred to a table of cookies that it did not contain; neither was true, and neither is said now. Analytics, which ran for every visitor with no way to refuse it, now needs consent in the European Economic Area, the United Kingdom and Switzerland and can be turned off everywhere; the table in section 3 lists every cookie the Website sets; the region hint that was stored as a cookie before any choice is no longer stored; and Global Privacy Control is honored. The same day, the panel was limited to the places where the law asks for consent first (section 2), a copy of each choice is now kept (section 8), and Cloudflare Turnstile now loads only on pages with a form (section 5). No right or obligation of yours was narrowed, and the change is recorded under our publication and correction policy. Earlier revision: September 23, 2026, the Flash Player end-of-life date written month first.
Revision note. Revised September 28, 2026. The copy we keep of a cookie choice now has an end: the page and the user agent are removed after 90 days and the copy is deleted 24 months after the choice, as the Retention Schedule sets out. No right or obligation of yours was narrowed, and the change is recorded under our publication and correction policy.
Revision note. Revised October 23, 2026. A preference cookie is added, trooth-theme-variant, set only when you choose a high contrast or color blindness theme in Appearance settings. The session cookie is now named __Host-trooth_session; the prefix tells your browser to accept it only from trooth.co over HTTPS, at the root path. Its purpose, contents and lifetime are unchanged, and the earlier name is replaced on your next visit. No right or obligation of yours was narrowed, and the change is recorded under our publication and correction policy.
Revision note. Revised October 23, 2026. The table now lists the cookies that mark a provider sign-in started from your settings as a connection to the account you are in. They are strictly necessary for that request and last at most 10 minutes. The change is recorded under our publication and correction policy.