Cookie Policy | Delivvo

The cookies Delivvo uses for sessions, portal access, preferences, and advertising measurement.

This Cookie Policy explains how Delivvo uses cookies and similar technologies on delivvo.io, inside the Delivvo dashboard, in Delivvo-hosted client portals, and on the public forms and pages businesses publish through Delivvo.

Cutroom, our desktop video editor, is not a website. It is an application that runs on your computer, and it sets no cookies. Signing in to it stores a licence session on your own machine. Buying it happens here on delivvo.io, using the same authentication cookies described below. What the app sends us about your licence is covered in the Privacy Policy.

What cookies are

Cookies are small text files placed on your browser or device when you visit a website. Some cookies are essential because they keep the site secure and functional. Others remember preferences, and some are used to measure advertising.

Delivvo uses cookies for authentication, portal access, and your preferences. We also load Meta's Pixel to measure our own advertising, and it sets Meta's cookies. Where we switch on Google Analytics, it sets Google's cookies too.

Cookies Delivvo uses

The table below reflects the cookies Delivvo currently sets itself.

Cookie	Purpose	Type	Typical duration
`sb-access-token`	Keeps a signed-in session active, for account holders, team members, and admins.	Essential	Short-lived session token, typically around 1 hour and refreshed as needed
`sb-refresh-token`	Refreshes the signed-in session without forcing a new login on every visit.	Essential	Up to 30 days
`portal_session`	Keeps an invited client signed in to a private project portal after one-time code verification.	Essential	7, 14, or 30 days, as the client chooses when signing in; 24 hours for a new client who has just accepted a proposal on its one-page close
`dlv_workspace`	Remembers which workspace you are actively viewing, for users who belong to more than one workspace.	Essential	Up to 30 days
`delivvo_locale`	Remembers your chosen language (English or Arabic).	Preference	Up to 1 year
`cookie_consent`	Remembers the choice you made on our cookie banner, so the banner does not show again.	Essential	Up to 1 year
`delivvo_impersonate`

If you choose not to stay signed in, sb-access-token and sb-refresh-token last only until you close your browser. While an email-link or Google sign-in completes, our sign-in provider may also set a short-lived cookie whose name starts with sb-.

In production, the authentication cookies (sb-access-token, sb-refresh-token) are scoped to the .delivvo.io parent domain so that the marketing site (delivvo.io) and the application (app.delivvo.io) recognise the same signed-in session.

Some interface states (your light or dark theme, your selected display currency, a collapsed sidebar, recently used colours, and the email address you typed on a payment page) are not stored in cookies at all. They are saved in your browser's local storage, which stays on your device. The free generators on our website (contract, invoice, proposal, and rate calculator) keep your draft in local storage only after you have made a choice on our cookie banner. An inquiry form you have started keeps your answers in that browser tab's session storage until you send it or close the tab.

Our own count of site visits sets no cookie and stores nothing on your device. The Privacy Policy describes how it works.

Delivvo may also set development-only cookies in local or demo environments for testing features. Those cookies are not intended for normal production use.

Why we use these cookies

We use cookies for these reasons:

to authenticate users and keep them signed in
to maintain secure access to private client portals
to remember basic interface state such as your active workspace and chosen language
to measure our own advertising, through the third-party cookies described below

Under the EU ePrivacy rules, cookies that are strictly necessary to provide a service requested by the user generally do not require prior consent. For Delivvo, that means the authentication, portal-access, and workspace cookies listed above, and the cookie that records your banner choice, are treated as essential.

The delivvo_locale cookie is a preference cookie. Delivvo treats it as optional because it only remembers your chosen language.

The Stripe cookies described under Third-party cookies below are set only when you open a payment form, and only to protect that payment against fraud. They are part of delivering the payment you asked to make.

Our cookie banner shows on your first visit to our site and app (it does not show inside client portals or on inquiry forms embedded in a business's own website) and records the choice you make in the cookie_consent cookie. Meta's Pixel and Google Analytics load only after you choose "Accept all". If you choose essential cookies only, neither loads. You can change your mind by deleting the cookie_consent cookie, which shows the banner again.

Third-party cookies

Meta. We load Meta's Pixel on the pages of our site and app, only after you choose "Accept all" on our cookie banner, and never on the pages businesses share with their clients through Delivvo (inquiry forms, booking, signing and proposal pages), to measure our own advertising and to show our ads to people likely to want Delivvo. It never loads on payment pages or inside client portals. The Pixel sets Meta's cookies, such as _fbp and, when you arrive from a Meta ad, _fbc. They typically last up to 90 days. They are Meta's cookies, used under Meta's privacy policy; the names and lifetimes are Meta's to change. What we send Meta with them is described in the Privacy Policy under "Advertising and measurement".

Google. Where we switch on Google Analytics, it loads on the same pages as Meta's Pixel and sets Google's cookies, such as _ga, which can last up to about 2 years, under Google's privacy policy.

Payment gateways. When a client pays an invoice or a payment link, a gateway's card form (for example Stripe's) may be loaded into the page so that card details go straight to the gateway and never touch our servers. Stripe sets its own cookies at that point (currently __stripe_mid and __stripe_sid) to detect fraud on the payment. They are Stripe's cookies, set for Stripe's purposes, and governed by Stripe's privacy policy rather than this one. The names and lifetimes are Stripe's to change. They are set only on pages with a payment form, they are not used for advertising, and Delivvo does not read them. Other gateways' card forms work the same way under their own policies.

Paying for a Delivvo subscription or a Cutroom licence sends you to Stripe's own hosted checkout page on Stripe's domain, where Stripe's cookies apply and ours do not.

If Delivvo later introduces other embedded experiences that set additional cookies, we will update this policy.

How to control or clear cookies

Most browsers let you review, block, or delete cookies through browser settings. Content blockers can also stop Meta's Pixel and Google Analytics from loading.

Please note:

deleting sb-access-token or sb-refresh-token will sign you out of Delivvo
deleting portal_session will sign you out of any client portal you are using
deleting delivvo_locale will reset your saved language preference
deleting cookie_consent will show the cookie banner again
blocking or deleting Meta's or Google's cookies does not affect how Delivvo works

Blocking essential cookies may prevent Delivvo from working correctly.

Changes to this policy

We may update this Cookie Policy from time to time to reflect product, legal, or infrastructure changes.

Contact

Questions about this Cookie Policy can be sent through the Support button at the bottom of any page on delivvo.io.

Questions about this document?