01A small amount of storage
Cookies are small files a website stores in your browser. Local storage and session storage keep information on your device without sending it with every request. This policy covers Timebird’s website and the embedded webview in Timebird for Mac. Read it alongside our Privacy notice.
Timebird currently uses sign-in cookies, connection protection, functional device storage and interface preferences. The website also uses Vercel Web Analytics and Speed Insights to measure visits and performance without analytics cookies. These services receive page paths and performance data; Timebird removes URL query values and booking identifiers before sending them.
02Sign-in and connection cookies
These cookies support authentication, session protection and connections you request. Names and expiry can differ as authentication providers update their libraries. A stored authentication cookie does not guarantee that an expired or revoked session remains valid.
| Name / category | Purpose | How long |
|---|---|---|
| cally-signed-in | Marks the browser’s signed-in period. | 30 days, or until sign-out. |
| cally-session-established | Recognises a previously established session so Timebird can handle returning visits. | Up to 400 days, or until sign-out. |
| sb-…-auth-token (including numbered chunks) | Supabase authentication and session refresh. The project identifier forms part of the name. | Up to 400 days; can refresh during use. Timebird’s browser sign-in period is separately limited to 30 days. |
| sb-…-auth-token-code-verifier | Protects sign-in and recovery redirects using PKCE verification. | Removed when the flow completes; an unfinished flow may persist up to the authentication library’s 400-day default. |
| cally-google-flow | Protects a Google connection attempt and associates its callback with your account. | 10 minutes; removed after the callback. |
| cally_slack_oauth / cally_slack_link | Protects an optional Slack installation or account-linking flow. | 10 minutes / 15 minutes; removed after the relevant flow completes. |
03Information on your device
These records support the features you use and the preferences you select. They are separate from cookies, but still involve storing information on your device. Use your own device for private calendars, and sign out on shared devices.
| Name / category | Purpose | How long |
|---|---|---|
| Mac update preference: cally:updates:auto:v1 | Remembers whether the installed Mac app checks for updates automatically. A check does not install or restart the app. | Until changed in Preferences or removed from device storage. This preference can survive sign-out. |
| Calendar snapshot: cally:calendar:v1:… | An account-specific copy of calendar accounts and events, including titles, times, locations and notes, for faster reopening. | Snapshots older than 7 days are discarded when read. Sign-out clears saved calendars; disconnecting an account removes its cached events. |
| Task storage and interface preferences | Cached tasks and your selected sidebar, chat, width, zoom, appearance and menu-bar preferences. Exact keys differ between web and Mac. | Until reset, cleared by the relevant feature or removed from device storage. Preferences can survive sign-out. |
| Mac authentication: cally-desktop-auth | The Mac webview keeps the session and refresh credentials needed to stay signed in. | Until sign-out, provider invalidation or device-storage removal; access tokens expire and can be refreshed. |
| Booking draft: cally-booking:… | Session storage keeps a guest’s booking input and verification information to recover an interrupted submission. | For the tab’s session, or until the booking is completed or reset. Browser session restoration can preserve tab storage. |
04When you visit another service
Choosing Google or Apple sign-in, connecting a provider, opening Creem checkout or following a footer AI link takes you to that provider. It may use its own cookies under its own policy. Timebird’s footer logos are served from Timebird; they do not embed the AI providers’ scripts or contact them before you click.
Hosting providers may also operate security and abuse-prevention measures. We do not use these to build advertising profiles.
05Your storage choices
You can block or delete cookies and site data in your browser’s privacy settings. Blocking authentication storage can prevent sign-in, connection flows or session recovery. Clearing local storage can remove cached tasks and interface choices; save information you want to keep first.
Sign out to clear Timebird’s session credentials. In the Mac app, appearance and menu-bar choices can be changed under Your space → Preferences. Your browser’s storage controls do not control the Mac app’s separate webview. For help clearing Mac app data, contact hello@timebird.space.
Timebird does not currently read Do Not Track or Global Privacy Control signals to change its storage behaviour. It does not sell personal information or share it for cross-context behavioural advertising. If optional tracking is added, we will explain it and provide any legally required consent or opt-out controls before enabling it.
06Changes and questions
The updated date identifies this version. We will revise the inventory when storage practices change. Ask about cookies or device data at hello@timebird.space. For access or deletion requests, see your privacy choices.