Cookie Notice

Getuser stores only the following in your browser. Each one is there only to provide something you asked for: it is strictly necessary, or, for the language and theme cookies, it remembers a choice you made yourself.

• Sign-in cookie: sb-<project>-auth-token. Set by Getuser’s own site, through Supabase (our sign-in provider), when you sign in. It holds the token that tells Getuser which account you are signed in to; without it you would have to sign in again on every page. If the token is long, it is split into parts ending in .0, .1 and so on. It is a first-party cookie, sent only to Getuser, with SameSite=Lax so that other sites cannot send it along with their own requests. Getuser’s own pages can read it (Supabase’s sign-in library needs that), but no other site can. It lasts as long as you stay signed in (your browser keeps it for at most 400 days) and is removed when you sign out.
• Sign-in helper cookie: a cookie whose name starts the same way and ends in -code-verifier. Set briefly while you sign in, to check that the email link or Google sign-in is completed in the same browser that asked for it. It is used only for that sign-in.
• Remember me cookie: wrap-remember. Set when you sign in or create an account, holding 1 if “Remember me” is ticked and 0 if not. Ticked, the sign-in cookie lasts as described above; unticked, Getuser writes the sign-in cookie without an end date, so your browser deletes it when you close it. It is a first-party cookie, sent only to Getuser, for the whole site, with SameSite=Lax; Getuser’s own pages read it, so it is not httpOnly. It holds only that 1 or 0 and lasts 400 days.
• Language and theme cookies: wrap-lang and wrap-theme. Set only when you click the language switch (wrap-lang, holding en or id) or the theme switch (wrap-theme, holding system, light or dark), to remember your choice so that every page, including the first one our server sends, appears in that language and theme. Until you click, Getuser follows your browser’s language and your device’s light or dark setting, and stores nothing. They are first-party cookies, sent only to Getuser, for the whole site, with SameSite=Lax. Getuser’s own pages read them, so they are not httpOnly. They hold only the option you picked, nothing that identifies you, and last one year, after which your browser forgets them; picking again starts the year again.
• Account connection cookie: wrap-social-oauth. Set only when you click to connect an Instagram or TikTok account, and deleted as soon as you come back from the platform’s consent screen (at the latest after ten minutes). It holds, encrypted, a random code that proves the answer coming back from Instagram or TikTok belongs to the request you started, for your account. It is a first-party cookie, sent only to the part of Getuser that handles connections, with SameSite=Lax; it is httpOnly, so no page script can read it.
• Studio draft: wrap:studio-draft:<workspace> in local storage. Local storage is space in your browser that only Getuser’s pages can read; it is not sent to our servers on its own. While you edit a video in the Studio, Getuser keeps your unsaved choices there (the format, the line and ending text, which clips, uploads and music you picked, and your settings; not the files themselves), so it can offer to continue where you left off if the tab closes. It is offered back for up to 7 days, and removed when you render the video or choose Start fresh. It stays on this device.

Bot check, only if switched on: Cloudflare Turnstile. It is off today. If we switch it on, the sign-up and password reset forms load a check from Cloudflare (challenges.cloudflare.com) that tells people from bots, without a puzzle in most cases. While you fill in the form, Cloudflare’s script collects your IP address and information about your browser and device (such as its user agent, settings and how the form is used), and puts a one-time token in the form, which Getuser checks with Cloudflare when you send it. Getuser stores nothing in your browser for it. If the check keeps anything in your browser, Cloudflare sets it on its own domain, only for the check, as its Turnstile Privacy Addendum describes. Cloudflare is listed on the Subprocessors page.

• No analytics cookies, and no analytics tools running in your browser.
• No advertising cookies, tracking pixels or social media plug-ins.
• No third-party cookies, other than anything Cloudflare’s bot check above may set while it is on, and no tracking across other sites.
• No requests to Google Fonts: Getuser’s fonts are served from Getuser’s own site.
• No error monitoring in your browser: if we switch on error reports, they come only from our servers.

The usage statistics described in the Privacy Policy are recorded in our own database when things happen in your workspace, not in your browser, and use no cookies.

In the EU and the UK, a website must ask before it stores information on your device, unless the storage is strictly necessary to provide a service you have asked for (ePrivacy Directive art. 5(3); UK Privacy and Electronic Communications Regulations, reg. 6(4)). Everything listed above falls within that exception: the sign-in cookies keep you signed in, the connection cookie secures a connection you asked for, the draft restores work you were doing, and the language and theme cookies are set only when you click to choose a language or theme, to remember that choice (what European data protection authorities call user-interface customisation). Cloudflare’s bot check, if we switch it on, is there only to keep bots out of the sign-up or password reset you asked for, so it is strictly necessary too. So we explain them here instead of showing a banner.

Indonesian law has no separate rule on cookies. The personal data in them (the sign-in token) is processed to perform our agreement with you (UU PDP art. 20(2)(b)), as the Privacy Policy explains. The language and theme cookies hold only the option you picked.

• Sign out to remove the sign-in cookie.
• Render the video, or choose Start fresh in the Studio, to remove the draft.
• Pick another language or theme to change those cookies. Signing out does not remove them; clearing cookies for Getuser does, and Getuser then follows your browser and device settings again.
• Clear cookies and site data for Getuser in your browser’s settings to remove all of them. In most browsers this is under Settings, then Privacy (or Privacy and security), then Cookies and site data.

You can block cookies in your browser, but then you cannot sign in to Getuser, and Getuser cannot remember a language or theme you pick. A private or incognito window deletes all of them when you close it.

If we ever want to store anything that is not strictly necessary, such as analytics, advertising or error monitoring in your browser, we will first update this notice and ask for your consent, with an equally clear choice to say no, before anything is stored. Saying no will not stop you from using Getuser.

Write to privacy@getuser.app. How we handle personal data in general is in the Privacy Policy, and the companies that process it for us are on the Subprocessors page.