> ## Documentation Index
> Fetch the complete documentation index at: https://docs.spitshake.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Cookie Policy

> How SpitShake uses cookies and similar technologies — and how to control them.

<Warning>
  **Draft pending counsel review.** Not legal advice. Do not rely on as a final policy until this banner is removed.
</Warning>

This policy explains the cookies and similar technologies SpitShake uses, what they are used for, and how you can control them. This policy supplements our [Privacy Policy](/legal/privacy).

## What is a cookie

A cookie is a small text file that a website places on your device when you visit it. Similar technologies include local storage, session storage, and pixel tags; this policy uses the word "cookies" to refer to all of these.

## Categories

We group cookies into four categories. You can change your preferences for three of them — strictly necessary cookies cannot be disabled because the service cannot function without them.

### 1. Strictly necessary

Used for core functions like keeping you signed in, protecting against cross-site request forgery, remembering your session during a multi-step signing flow, and enforcing security decisions. Disabling these would break the product.

Examples: session cookie, CSRF token, signing-session identifier.

### 2. Preferences

Remember choices you make — for example, language, time zone, or whether you want to keep a typed signature for reuse in the same device. These are not required for the service to work; you can disable them and simply set your preferences each visit.

### 3. Analytics

Help us understand how the product is used in aggregate: which features tenant administrators find, where signers get stuck in the flow, which pages are slow. Analytics cookies are set on the tenant administrator console only and are **not** set on signer-facing signing pages.

### 4. Advertising

We do **not** set advertising cookies or share personal information with ad networks. This category is listed for transparency; it contains no cookies today.

## Global Privacy Control

SpitShake honors the **Global Privacy Control (GPC)** signal. If your browser sends a GPC header, we treat it as a valid opt-out of any "sale" or "sharing" of personal information as those terms are defined under California law. Because we do not sell or share personal information for cross-context behavioral advertising in the first place (see our Privacy Policy), GPC does not materially change how we handle your data — but we log and respect the signal as required.

## Your controls

* **In your browser**: block or delete cookies via your browser's privacy settings. This may break strictly-necessary functionality.
* **In the product**: a preference-center link (when available on the relevant page) lets you opt in or out of the Preferences and Analytics categories.
* **At the OS level**: enable your browser's Do Not Track or GPC signal — we honor GPC.

## Third-party cookies

Some categories above are set by our subprocessors on our behalf (for example, Sentry for error monitoring, or PostHog for tenant-console analytics). These third parties are listed in our [Subprocessors Register](/legal/subprocessors) with their purposes and regions.

## Changes to this policy

We may update this policy as we add or remove cookies. Material changes will be noted in the "Last updated" date and, where the change adds a new category or new third-party cookie, will take effect on the next renewal of your account (for tenants) or the next session (for signers).

***

*Service provided by IVERIFI, LLC d/b/a SpitShake (a Connecticut limited liability company wholly owned by ADS CORP). Last updated: 2026-04-19.*