Cookie Policy
Last updated: 13 August 2026
This page lists everything Communioo stores in your browser — cookies, local storage and session storage — what each item is for, and how long it lasts. It is the complete list, not a selection: there is nothing stored that is not named below.
What we don't do
Shortest section first, because it is the part most people came to check:
- No advertising cookies, no tracking cookies, and no cookie-based analytics.
- No third-party scripts, tags, pixels or fonts loaded from anyone else's server on the pages we serve. The one exception is a video an association has added to its own website: nothing is fetched from YouTube or Vimeo until you click the play panel, which says so before you do. Once you click, that provider's own player loads and their terms apply — see “Videos on an association's website” below.
- Nothing described here is sold, shared, or used to follow you across other websites.
- One question, asked once, on an association's website: may we keep a random visit id in your browser. Nothing is stored until you answer, saying no is one click and costs you nothing, and we remember the answer so you are not asked again. There is no question on communioo.com, because there is nothing to store — see the last two sections.
If you are not signed in
Arrive at communioo.com, or at an association's own website running on Communioo, and we set no cookies on your device — and, since 30 August 2026, nothing else either. Arriving stores nothing at all. On an association's website you are asked whether we may keep the random visit id described under Session storage below; it is written only if you say yes, and your browser deletes it when you close the tab.
Two things you can do while signed out will store something, and both are your own action rather than ours: dismissing the storage notice saves that you have seen it, so it does not follow you from page to page; and changing the theme or text size saves that choice. Nothing else on this page applies until you sign in.
Cookies
All three are first-party — set by Communioo on the site you are visiting, and readable by nobody else.
| Name | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
| sb-…-auth-token | Supabase (our authentication provider, first-party) | Keeps you signed in. Your browser may store it split across numbered parts (…-auth-token.0, …-auth-token.1). Signing out ends the session. | Up to 400 days, renewed while you keep using Communioo | Strictly necessary |
| sb-…-auth-token-code-verifier | Supabase (our authentication provider, first-party) | A one-time random value that makes the sign-in link in your email safe to use. It is written when you start signing in, used once to finish, and overwritten the next time you sign in. | Up to 400 days | Strictly necessary |
| communioo_storage_notice_ack | Communioo (first-party) | Records that you have dismissed the short notice at the bottom of the page, so it is not shown to you again. It only ever holds the value 1. | 6 months | Functional |
| communioo_cookie_consent | Communioo (first-party) | Your answer to the one question we ask: whether we may keep a random visit id in your browser while you look around an association's website. It holds either “all” (you agreed) or “essential” (you declined), and nothing else. It is written only when you press one of the two buttons — never on arrival, never if you ignore the question. Remembering that you said no is the only way we can stop asking you. | 6 months | Strictly necessary (it records your own choice) |
Local storage
Local storage is a small store your browser keeps for a website. It is not a cookie: none of it is attached to requests or sent to our servers. Everything here is a preference you set by your own click, it stays until you or your browser clears it, and clearing it costs you nothing but the preference itself.
| Name | What it holds |
|---|---|
| theme | Whether you chose the light or the dark appearance. |
| fontSize | The text size you chose in the members' area (regular, medium or large). |
| communioo:recentSearches | The last six things you typed into the search box in the members' area, so the box can offer them back to you. The words stay on your device — searching sends the query to us to answer, but this list is never uploaded. |
| communioo_storage_notice_ack | A copy of the cookie above, so the notice stays dismissed even if the cookie is cleared. |
| communioo_cookie_consent | A copy of the consent cookie above, for the same reason: so your answer survives the cookie being cleared. Written only when you answer. |
Session storage
Session storage works the same way as local storage with one difference that matters: your browser deletes it when you close the tab. Nothing here survives the visit.
| Name | What it holds |
|---|---|
| cmo_sid | A random visit id, used to tell the pages of one visit apart from another visit’s when counting. It is not linked to you, to an account, or to any visit you make later, and your browser deletes it when you close the tab. Two conditions must BOTH hold before it is written: the association whose website you are reading has visit counting switched on, and you pressed “Yes” on the question at the bottom of the page. If either is missing — including if you simply never answer — nothing is written. It is never written on communioo.com at all. |
| communioo.ai.result.… | Only if your association has the AI assistant switched on, and only in the staff area: an answer the assistant has generated, kept so that reloading the page does not lose it. It is deliberately held in session storage rather than on disk, so it does not outlive the tab. |
Visit measurement
We count page visits, and we do it without cookies. This happens on communioo.com and on the public websites we host for associations — both, so that neither is a surprise.
On an association's website, the association can see how their own site is being used. To tell one visit apart from another we generate the random id described above and keep it in session storage, which your browser clears when you close the tab. For each page we record the page address on that site, the website you arrived from (its domain only, never the full address), how many times you clicked, and how long the page was open. If you decline, the id is never written down — it exists in the page’s memory for as long as that page is open and vanishes with it — so each page you open is counted as a separate visit. That makes the association’s “unique visits” figure an over-count rather than making you invisible, and their own dashboard says so. The association sees totals; we keep the individual visit records for 120 days by default — an association can shorten or lengthen that for its own site, within limits we fix, and never beyond 365 days — and then delete them. On communioo.com we count page visits only — the visit id is created by the same code but nothing records it.
No IP address, no browser fingerprint and no account is stored against any of it. There are two separate controls, and it is worth being precise about what each one does, because they are not the same thing. Yours is the question at the bottom of an association's website: it decides whether anything is stored in your browser. Decline, or ignore it, and nothing is — but the page you asked us for was still requested, and it is still counted, because counting a request we received does not involve your device at all. We would rather say that plainly than let a “no” imply more than it delivers. The association's is a switch over their whole site: when they turn it off, nothing is written to your device, nothing is counted, and you are not asked the question at all. On communioo.com that second decision is ours, and we store nothing there in either case.
Videos on an association's website
An association can place a YouTube or Vimeo video on its own public website. We do not load it for you. You see a still picture with a play panel that says which provider it would contact, and nothing leaves your browser for that provider until you press it. YouTube videos are framed through youtube-nocookie.com, which is YouTube's own no-cookie player address.
If you do press it, that provider's player is loaded from their servers and whatever they store is theirs, under their terms, not ours — it is not part of the list above. Not pressing it costs you only the video.
The one choice we do offer
For years this section said the opposite, and the change is recent enough to be worth explaining. The cookie communioo_cookie_consent existed in our code and was written by nothing, because there was nothing on this page to decline. That stopped being true the moment we looked properly at the visit id: it is stored on your device, it is not needed to show you the page, and nobody had ever been asked. So since 30 August 2026 it is a real choice, on association websites, and that cookie is what remembers your answer.
What it is not: a list of vendors, a “legitimate interest” tab, or an accept button three times the size of the refuse button. It is one question with two equal answers. Changing your mind means clearing this site's cookies and site data in your browser, at which point you will be asked again. Everything else on this page is either strictly necessary or something you stored by your own click, so there is nothing further to consent to — and if that ever changes, this page will say so before the storing starts, not after.
Questions
See our Privacy Policy for how we handle your data more broadly, or email privacy@communioo.com.