Cookie Policy

How TemplateHub uses cookies and similar technologies on the website.

Effective: To be announced
Updated: 6 August 2026
Version: 0.2-content-draft

Content draft. This page reflects TemplateHub’s intended practices based on the current product stack. It is not yet final counsel-approved wording and is not binding until an official effective date is published.

1. What Cookies Are

Cookies are small text files placed on your device when you visit a website. They are widely used to make sites work, keep you signed in, remember choices, and understand how a service is used.

Similar technologies include browser local storage, session storage, and comparable client-side storage that applications use for the same kinds of purposes. In this policy, references to “cookies” include those similar technologies unless a distinction is useful.

This Cookie Policy explains how TemplateHub uses cookies and similar technologies on the current product. It is a content draft aligned to repository behaviour — not legal advice and not final until an Effective date is published after business confirmation and counsel review.

2. How TemplateHub Uses Cookies

TemplateHub uses cookies and similar technologies to:

Keep you signed in and protect account sessions (authentication).

Support two-factor authentication (2FA) challenge and verification state where that security feature is used.

Operate essential marketplace flows such as browsing while signed in and securing dashboard routes.

Remember cart contents between visits using client-side storage.

Remember a lightweight sign-in preference (last method used) on the sign-in page.

Measure basic web analytics and performance via the deployment platform’s analytics and speed-insights tools currently loaded on the public site.

Support error monitoring and session replay diagnostics through Sentry when that client integration is enabled for the deployment.

We use only categories that match technologies present in the current product. We do not invent additional tracking products for this draft.

3. Cookie Categories

For clarity — and for future cookie-banner / preference-centre compatibility — TemplateHub groups cookies and similar technologies as follows. Only categories that apply today are described as in use.

3.1 Strictly necessary

Required for core security and account operation. Without these, sign-in, session continuity, OAuth sign-in handshakes, and 2FA flows cannot work reliably.

Includes authentication session cookies, short-lived OAuth state cookies, and 2FA-related cookies described in Section 4. These are treated as essential platform operation rather than optional marketing tools.

3.2 Functional / preferences

Help the marketplace remember choices that improve usability but are not required for basic page load.

In the current product this includes client-side cart persistence and last-used sign-in method storage (local storage keys, not HTTP cookies). See Section 4.

3.3 Analytics and performance

Help us understand aggregate traffic, navigation, and performance characteristics of the site.

TemplateHub currently loads Vercel Analytics and Vercel Speed Insights in the root application layout. When enabled via configuration, TemplateHub also loads the Sentry browser client for error monitoring and session replay (see Section 4). Exact cookie names, retention, and whether those tools set first-party or third-party identifiers can vary by provider configuration and are TBD / provider-documented detail for final counsel wording.

This draft does not claim that analytics are “strictly necessary,” “anonymous only,” or “GDPR-exempt.” Lawful basis and consent requirements for analytics will be confirmed with counsel and, where required, paired with consent UX (see Section 6).

3.4 Marketing

Marketing or advertising cookies (for example third-party ad pixels, retargeting tags, or social advertising SDKs) were not found as first-party integrations in the current TemplateHub application code reviewed for this draft.

If TemplateHub later adds marketing tags, this category and the cookie inventory will be updated before those technologies are treated as covered by a final published policy.

4. Specific Cookies and Storage

The following inventory reflects technologies identified in the current TemplateHub codebase. Names and lifetimes may change as the auth stack or product evolves; material changes will be reflected in a later revision of this page.

4.1 Authentication session

Name (development): better-auth.session_token

Name (production / HTTPS): __Secure-better-auth.session_token

Purpose: Maintains your signed-in session with TemplateHub’s authentication stack (Better Auth–compatible session token).

Type: HTTP cookie; httpOnly; SameSite=Lax; Secure in production.

Lifetime: about 7 days. TemplateHub configures Better Auth session expiry to 7 days, and the custom 2FA completion path sets the same approximately 7-day maxAge when it re-issues the session cookie. Session activity may refresh within that window under the auth stack’s update settings.

Category: Strictly necessary.

4.2 Two-factor authentication cookies

two_factor_verified — records that the current session completed 2FA verification (HMAC-signed value bound to the session). HTTP cookie; httpOnly; SameSite=Lax; Secure in production; typical maxAge about 7 days on the path that sets it. Category: Strictly necessary (security).

2fa_challenge — temporary challenge identifier while a user completes 2FA after password verification. HTTP cookie; httpOnly; SameSite=Lax; Secure in production; short-lived (currently about 15 minutes). Cleared when verification succeeds or fails. Category: Strictly necessary (security).

4.3 OAuth state cookies (Better Auth)

During social sign-in (Google, GitHub, Discord, or Microsoft), Better Auth sets a short-lived first-party state cookie to protect the OAuth handshake (CSRF/state integrity).

Typical names (library defaults): better-auth.oauth_state or better-auth.state in development; with the __Secure- prefix in production/HTTPS when secure cookies are used. Exact name depends on Better Auth’s OAuth state-storage strategy for the request.

Type: HTTP cookie; httpOnly; SameSite=Lax; Secure when the secure cookie prefix applies. Short-lived (on the order of about 5–10 minutes per library defaults).

Category: Strictly necessary (authentication).

4.4 Cart storage (local storage)

Key: templatehub-cart (Zustand persist store in the browser).

Purpose: Remembers items you add to the shopping cart so the cart can survive page reloads and return visits on the same browser/profile.

Type: Browser local storage (not an HTTP cookie). Stores product identifiers and display fields needed for cart UI (for example name, price, thumbnail URL, license type) — not payment card numbers.

Category: Functional.

4.6 Analytics and performance tooling

Tools: Vercel Analytics and Vercel Speed Insights, mounted in the root layout for the public site.

Purpose: Aggregate usage and performance measurement for the deployed application.

Storage detail: Specific cookie or storage key names set by these vendor scripts are provider-controlled and not hard-coded as first-party names in TemplateHub application source. Exact inventory, duration, and IP/device handling: TBD from current Vercel product documentation at finalization.

Category: Analytics and performance.

4.7 Error monitoring and session replay (Sentry)

Tool: Sentry browser client (@sentry/nextjs), initialized when a Sentry DSN is configured for the deployment (disabled when no DSN is set).

Purpose: Error monitoring, performance tracing, and Session Replay diagnostics for the web application.

Similar technology: Session Replay uses browser session storage. The Sentry replay package stores replay session state under the key sentryReplaySession (vendor default). Additional Sentry cookie or storage keys, if any, are provider-controlled and not hard-coded as first-party names in TemplateHub application source.

This draft does not claim that Sentry data is anonymous-only or free of personal information. Lawful basis and retention for error monitoring and replay will be confirmed with counsel before final publication.

Category: Analytics and performance (diagnostics / error monitoring).

5. Third-Party Cookies

Some features take you to, or load resources from, third-party services that may set their own cookies under their own policies:

Payment: Checkout is completed through the active payment processor (currently Stripe Checkout). When you pay, you interact with Stripe-hosted flows; Stripe may set cookies on its domains according to Stripe’s policies. TemplateHub does not store full card numbers as product state.

Sign-in with OAuth: If you choose Google, GitHub, Discord, or Microsoft sign-in, those identity providers may set cookies on their domains during authentication. TemplateHub’s own short-lived OAuth state cookies for the handshake are described in Section 4.3.

Deployment analytics: Vercel Analytics and Speed Insights are third-party (or platform-provided) scripts loaded by TemplateHub; any cookies or identifiers they use are governed by Vercel’s documentation and terms in addition to this policy.

Error monitoring: When enabled, the Sentry client sends diagnostic and replay-related data to Sentry under Sentry’s terms; see Section 4.7 for client-side storage detail.

Hosting, images, and other infrastructure: Content delivery, image hosts, and similar technical endpoints may set strictly technical cookies as part of normal web delivery. TemplateHub does not use those channels as a substitute marketing pixel layer in first-party code reviewed for this draft.

This Cookie Policy does not control third-party cookies on domains TemplateHub does not own. Review the relevant provider’s privacy/cookie materials for those services.

6. Managing Preferences

Browser controls: Most browsers let you block or delete cookies, and many let you clear local storage for a site. If you block strictly necessary cookies, sign-in, 2FA, and account features may stop working. If you clear local storage, cart contents and the last sign-in preference on that browser will be lost.

In-product cookie banner / preference centre: Not found in the current repository. A consent or preference UX is planned in the legal roadmap (Phase L1 product work after this Cookie Policy content draft) and is not shipped yet. Until that ships, there is no first-party TemplateHub UI to toggle analytics on or off beyond browser/vendor tools.

Analytics: Where your browser or a future TemplateHub preference centre offers controls, use those tools. Do not assume that closing a tab alone deletes all cookies or local storage.

Marketing emails are separate from cookies: newsletter subscription and unsubscribe are handled as account/marketing data under the Privacy Policy, not via a cookie category in this draft.

Future compatibility note: Category labels in Section 3 (strictly necessary, functional, analytics, marketing) are intentionally aligned so a later cookie banner can map toggles to the same groups without rewriting this policy’s structure.

7. Relationship to Privacy Policy

This Cookie Policy supplements the Privacy Policy. The Privacy Policy explains personal data collection, use, sharing, retention, and rights at a broader level — including a high-level summary of cookies and similar technologies.

Where this page describes a cookie or storage technology in more detail, it does not replace the Privacy Policy’s rules on how personal information is processed overall.

Related reading: Privacy Policy (/privacy), Terms of Service (/terms).

8. Updates and Contact

We may update this Cookie Policy when product behaviour, processors, or legal requirements change — for example if a cookie consent banner ships, analytics tools change, or marketing tags are added.

The version and Updated date at the top of this page will change when revisions are posted. An official Effective date will be set when a final version is adopted after business confirmation and legal review.

Questions about cookies or similar technologies should use TemplateHub’s designated privacy/legal contact once published.

Business input still required: dedicated privacy or legal email, legal entity name, and mailing address (if applicable) are not yet confirmed as canonical product configuration in this repository (Requires Business Input / TBD).

Operational path while details are finalized: use the Contact surface when available, or the support/email channel TemplateHub publishes in site chrome or transactional email footers.

Related policies: Privacy Policy (/privacy), Terms of Service (/terms), Refund Policy (/refund-policy), License Terms (/license), Seller Terms (/seller-terms), and DMCA / Copyright (/dmca).