Cookie Policy

Which cookies and similar technologies we use, why, and how you can control them.

Draft — needs counsel

This document is a structural draft from our specs. It has not been reviewed by qualified counsel.

Version:: 0.1.0-draft
Effective:: May 26, 2026
Updated:: May 26, 2026

What Are Cookies

Cookies are small text files placed on your device by websites you visit. They enable essential functions (like staying logged in) and help us improve our service.

Types We Use

Essential

Required for authentication, security, and basic functionality. Cannot be disabled.

__Host-bm_access — JWT access token (httpOnly)
__Host-bm_refresh — refresh token (httpOnly)
__Host-bm_csrf — CSRF protection token

Functional

Remember your preferences (theme, language, active organization). Implicit consent.

bm-theme — light or dark mode preference
bm-locale — language preference (EN, VI)
bm_active_org — currently selected organization

Analytics

Help us understand how the service is used. Opt-in only.

Google Analytics 4 — anonymized usage statistics
PostHog — feature usage and product analytics

Marketing

We do not currently use marketing cookies. If added in the future, they will be opt-in only.

How to Manage Cookies

Use our in-app cookie preference center (footer link or first-visit banner)
Configure your browser to block or warn before accepting cookies
Visit aboutcookies.org for general information

Blocking essential cookies

If you block essential cookies, you will not be able to sign in or use account features.

Updates

We notify users of material cookie policy changes via the in-app banner and email.