Cookie declaration

Effective 3 November 2026

These are all the cookies Corresso sets. All but one are strictly necessary: without them you could not sign in, submit a form safely, or keep the inbox as you left it. Cookies that are strictly necessary for a service you have asked for need no consent under Danish law (Cookiebekendtgørelsen, BEK nr. 1148 af 9. december 2011, § 4, stk. 1, nr. 2), so nothing asks about them.

The one that is not — PostHog’s, which measures our public pages — is set only if you choose Allow in the box on the front page, How it works or the sign-up page (§ 3). Inside the app, no cookie or script measures anything, whatever you chose. To change your mind, choose Cookie settings at the bottom of those pages.

Name	Set by	Purpose	Duration	Category
session_id	Corresso (first party)	Keeps you signed in. It holds only a signed number that points to your sign-in on our server, which ends when the cookie does.	30 days from when you sign in, or until you sign out	Strictly necessary
_corresso_session	Corresso (first party)	Protects forms against cross-site request forgery, carries one-off messages such as “Password has been reset”, remembers the page to return to after signing in, and holds a random value our content security policy uses to tell our own scripts from injected ones. It is encrypted, so it cannot be read or changed in the browser.	Until you close your browser	Strictly necessary
organization_id	Corresso (first party)	Remembers which organisation you are working in, once you have signed up or accepted an invitation, so a person in more than one organisation lands in the right one. It holds only a signed number.	Until you close your browser	Strictly necessary
inbox_sort	Corresso (first party)	Remembers the order you chose for your inbox (newest or longest waiting first), so it stays as you left it. It is set only when you choose an order, and holds only that choice.	1 year from when you last choose an order	Strictly necessary
ph_…_posthog	Corresso’s pages, for PostHog (first party)	Only if you choose Allow in the box on our public pages: lets PostHog, which measures those pages for us, tell one visit from the next. It holds a random id for your browser and the current visit. The … is our PostHog project’s public key.	1 year from when you allow it, or until you choose No thanks	Analytics — only with your consent

How they are protected

Each of Corresso’s own is sent only over HTTPS, cannot be read by scripts on a page (HttpOnly), and is not sent with requests that other websites make in the background (SameSite=Lax). PostHog’s is set by its script on our page, so that script can read it; it too is sent only over HTTPS, and only to our own site.

What we do not use

No advertising, social-media or tracking cookies, and no analytics cookie without your consent. (What our server counts of the actions people take inside Corresso involves no cookie; our privacy notice describes it.)
No local storage, session storage or similar storage in your browser, with these exceptions. On our public pages, your answer to the measuring box is kept in local storage (corresso:analytics-consent, the choice and its date), so the box does not ask on every page; after a year it asks again. That is strictly necessary to respect your choice. If you chose Allow, PostHog also keeps a few entries starting with ph_ in the tab’s session storage, gone when the tab closes; No thanks deletes them with its cookie. And once you send a message in a website chat — on a business's website, or when you try it in Settings — the chat keeps that conversation's random token in the tab's session storage (corresso-chat: and the chat's key), so the conversation is still there on the next page. It is gone when the tab closes, and nothing is kept before you write. It is strictly necessary for the chat you started.
No service worker or push subscription, unless you turn on browser notifications in Settings → Notifications and allow them when your browser asks. Your browser then keeps Corresso’s service worker (a small script that shows the notifications and does nothing else) and the push subscription it made. Both are strictly necessary for the notifications you asked for. To remove them, block notifications for Corresso in your browser’s site settings, or clear its data for this site.
No fonts or scripts from other companies’ servers. PostHog’s script, too, comes from our own server; only the measurements go to PostHog, in its EU cloud in Frankfurt (eu.i.posthog.com, and eu-assets.i.posthog.com for its settings), and only after you allow it. Our privacy notice explains what it receives.
No images from other companies’ servers, with one exception: in an organisation that has connected its Shopify store, the pictures of the products a customer ordered load straight from Shopify’s servers (cdn.shopify.com). Our privacy notice explains what Shopify receives.
No tracking in the email we send: open and link tracking is always off.

Removing them

Signing out deletes session_id, and closing your browser deletes _corresso_session and organization_id. You can delete all of Corresso’s own at any time in your browser’s settings; you will then simply be signed out, and the inbox shows newest first again. Choosing No thanks under Cookie settings deletes PostHog’s cookie.

The personal data involved

session_id holds only a signed number pointing to your sign-in on our server, which records the IP address and browser you signed in from. Our privacy notice explains how we handle that.