--- title: "Cookie & Storage Policy" bin.md_icon: "cookie" tags: - "bin.md policy" --- ![A coworker caught with his hand in the cookie jar, watched by a beagle and the cookie-patrol bot.](https://assets.bin.md/site-graphics/v1/code/cookie-cookie-patrol.webp) *Effective Date: October 1, 2026 · Last Updated: October 1, 2026 (v6)* This policy explains every cookie, browser storage entry, and third-party script that bin.md (operated by **GRiTT Information Services LLC, a Virginia limited liability company**) uses on your device. We aim to describe them accurately rather than at a level of generality. For related documents, see our [[:privvy|Privacy Policy]] and [[:termos|Terms of Service]]. ## Overview bin.md does not use advertising cookies, cross-site behavioral tracking, or third-party analytics scripts (Google Analytics, Plausible, Fathom, PostHog, Umami, Cloudflare Web Analytics, etc.). The cookies and storage we do use are for authentication, in-progress drafts, unlocking password-protected documents, remembering UI preferences, and running features like the in-product feedback widget. ## Cookies **Set by Clerk (authentication — strictly necessary).** Manage your login session. Set when you sign in and cleared when you sign out or the session expires. Scoped to the bin.md domain. Do not track you across other sites. **Set by bin.md.** | Cookie | Purpose | Scope | Lifetime | Flags | | --- | --- | --- | --- | --- | | `binmd_draft_token` | Ties an in-progress draft to your browser so you can return to it. Issued to both signed-in and anonymous users. | bin.md | Up to 30 days | HttpOnly, SameSite=Lax, Secure | | `bm_unlock_` / `binmd_unlock_` | Remembers that you unlocked a specific password-protected document so you don't have to re-enter the password on refresh. The API origin sets `bm_unlock_` (`Path=/v1/doc/`). The web origin sets `binmd_unlock_` (`Path=/`). Either name unlocks the document. | bin.md / api.bin.md | 1 hour per document | HttpOnly, SameSite=Lax | **Set by third parties.** - **Cloudflare** may set a `__cf_bm` cookie for bot management and DDoS protection. This is a security cookie and does not track you for advertising purposes. Governed by [Cloudflare's privacy policy](https://www.cloudflare.com/privacypolicy/). - **Userback** may set cookies scoped to `userback.io` when the in-product feedback widget is loaded. Signed-in users who turn the widget off from Settings → Privacy do not load the script, so those cookies are not set. Governed by [Userback's privacy policy](https://www.userback.io/privacy-policy). - **Embedded videos** — if a document embeds a video from Vimeo or Loom, that provider may set third-party cookies when their player loads. YouTube embeds use `youtube-nocookie.com` and do not set tracking cookies until you play the video. - **Billing / pricing pages** — when you visit a pricing or checkout page, Clerk's pricing-table component and Stripe's checkout may set cookies on their own domains that are strictly necessary for the payment flow (session, fraud prevention, CSRF). These are set only when you interact with billing pages. Governed by [Clerk's privacy policy](https://clerk.com/privacy) and [Stripe's privacy policy](https://stripe.com/privacy). ## localStorage (preferences and drafts) We use your browser's `localStorage` to save UI preferences, in-progress drafts, and (when the AI assistant is enabled and you use it) assistant conversation state. These entries live entirely on your device and are only accessible by bin.md pages. Drafts and assistant history are sent to our servers only when you save a document or continue an assistant conversation, respectively. Keys currently in use include: - **Theme and layout** — `binmd-theme` (dark or light); `binmd:create-editor-width` (create, document, and profile width — this is what the width toggles write); `binmd-doc-width` (legacy; read for compatibility only, no longer written; only the value `wide` is honored); and `binmd:list-display:*` keys for profile, bookmarks, and bookmark-doc list layouts. - **Search preferences** — `binmd.search.exclude_mine` (whether to hide your own documents from search). There is no stored “fast/deep” search-mode key. - **Draft cache** — `binmd:create:draft` and `binmd:create:draft:edit:` store unsaved markdown from the create/edit page until you publish, discard, or we clear it after a successful save. - **Server draft identifiers** — `binmd:create:server-draft-id` and `binmd:create:server-draft-id:edit:` reconcile the local draft with our server-side draft store. - **AI assistant state** — `binmd:asst::` and `binmd:asst-drawer-pinned` (Plus+, when you use the assistant). Chat history and edit patches are cached locally so you can resume. These are sent to Cloudflare AI Gateway and downstream AI providers as described in the [[:privvy|Privacy Policy]]. - **Client configuration** — `binmd.smoothStream` (optional assistant-stream smoothing override). ## sessionStorage (short-lived secrets) `sessionStorage` is cleared when you close the tab. We use it for short-lived secrets and one-shot UI flags: - `binmd_doc_pw:` — the password you entered to unlock a password-protected document, held only for the current tab. - `binmd_doc_admin:` — the admin key you were shown when you created an anonymous document, held only for the current tab so you can edit or delete it. - `binmdFwdSlug:` — the Plus+ forwarding slug chosen on create, held only for the current tab. - `binmd:asst-refs:` — assistant reference chips (Plus+; cleared with the tab). - `binmd:create:resetBfCache` / `binmd:create:resetBfCache:new` — one-shot create/edit back-forward-cache reset flags. Passwords and admin keys are stored in the clear in the current tab's memory and are cleared when the tab closes. Do not open bin.md on a shared or untrusted device without closing the tab when you leave. ## What we don't use To be explicit: - **No advertising cookies** — we have no ad network relationships. - **No cross-site tracking** — we do not use pixels, fingerprinting, or other tracking technologies. - **No third-party analytics scripts** — no Google Analytics, Plausible, Fathom, PostHog, Umami, or Cloudflare Web Analytics. ## Third-party scripts For transparency, the following scripts are loaded from third-party CDNs: - `kit.webawesome.com` — Web Awesome UI component library (every page). The kit also loads scripts and styles from `ka-p.webawesome.com` and icon SVGs from `ka-p.fontawesome.com`. - `unpkg.com/@mcp-b/global` — MCP browser integration library (every page). - `static.userback.io` — Userback feedback widget (see below). Loaded for guests and for signed-in users who have not turned it off. When the widget is loaded, it identifies you to Userback using your Clerk user ID, email, name, and plan tier, and can capture screenshots or short screen recordings of the current page when you submit feedback — including private document content that is on screen at the time. Full disclosure is in the [[:privvy|Privacy Policy]] processor table. Signed-in users can turn the widget off from Settings → Privacy. When it is off, `static.userback.io` does not load and Userback does not set cookies for that session. Guests still get the widget. ## No consent banner Because we do not use advertising or analytics cookies, and because the cookies we do set are either strictly necessary (authentication, drafts, unlock) or set by infrastructure and payment providers (Cloudflare, Clerk, Stripe, embedded video) only when you use those features, we do not display a cookie consent banner. The Userback widget is optional for signed-in users (Settings → Privacy) and is the only third-party product script you can turn off. If that changes — for example, if we ever introduce non-essential tracking — this policy will be updated and consent will be requested where required. ## How to clear cookies and storage You can clear all cookies, `localStorage`, and `sessionStorage` at any time through your browser settings: - **Chrome / Edge:** Settings → Privacy and security → Clear browsing data → Cookies and site data / Local storage - **Firefox:** Settings → Privacy & Security → Cookies and Site Data → Clear Data - **Safari:** Settings → Privacy → Manage Website Data Clearing your session cookie will sign you out. Clearing `localStorage` will reset your UI preferences and any unsaved drafts. Clearing `sessionStorage` will require you to re-enter document passwords and re-copy admin keys. ## Changes to this policy If we add or change cookies or storage mechanisms, we will update this policy and revise the Last Updated date. Material changes to what we track (if any) will be communicated in the Service or by email. ## Contact For questions about this policy, contact us at [support@bin.md](mailto:support@bin.md). ## Stay notified :fa-bell: This document changes as bin.md does. Subscribe to this document to be notified whenever it’s updated.