Cookie notice
Status: Draft, pending legal review. Version 1.0. This page will show an effective date and a “What changed” note once it is final. Our disclaimers page explains what a draft means.
The short version
We use only the cookies and browser storage that Amyn needs to work. Today, this website sets none at all. When the dashboard opens, it will keep your sign-in session in your browser and may remember a preference you choose. That is the whole list.
We use no analytics cookies, no advertising cookies, no session recording and no third-party cookies. Nothing on this site follows you to other websites. Because there is nothing to opt out of, we do not show a cookie banner.
What this notice covers
This notice covers:
- the website at amynpos.com (the “website”);
- the signed-in area at amynpos.com/app where a merchant runs its account (the “dashboard”), once it opens; and
- the Amyn software that rings up sales on registers, tablets and phones (the “point of sale”), once it ships.
The website and account terms define the words we use in every policy. Read this notice together with our privacy notice, which explains what personal data we collect and why. If the two ever disagree, this notice wins on cookies and the privacy notice wins on everything else.
What cookies and local storage are
A cookie is a short note that a website leaves in your browser. Each time you come back, your browser hands the note over, which is how a site tells one visitor from another. Local storage is a drawer in the same browser. A site can put small items in that drawer, but your browser never posts them anywhere by itself. Only the site’s own code, running on the site’s own pages, can read them.
Both can be used for good reasons, such as keeping you signed in. Both can also be used to follow you around the web. We use them only for the first kind of job.
Session storage is a short-lived cousin of local storage that the browser empties when you close the tab. We mention it so the list is complete. We do not use it today.
What we set, and when
The table below lists everything Amyn stores in your browser. It is complete, not a sample.
| Name | Where | Purpose | Lifetime | Set by | Status |
|---|---|---|---|---|---|
Entry beginning sb- and ending -auth-token | Local storage, dashboard only | Keeps you signed in to the dashboard. It holds your session tokens so you do not have to sign in on every page. | Until you sign out, end the session from Settings, or the session times out. We will publish the exact timeout before launch. | Supabase, Inc., our sign-in service | At launch |
Entry beginning sb- and ending -code-verifier | Local storage, dashboard only | A one-time code that proves the sign-in you started is the one you finish. | Removed as soon as sign-in completes. | Supabase, Inc. | At launch |
| Preference entry | Local storage, dashboard only | Remembers a choice you made, such as your language or a notice you dismissed, so we do not ask again. | Until you clear it. We will publish the exact name and lifetime before launch. | Amyn | Planned |
A few notes on the table:
- Today the website stores nothing. The waitlist form, the contact form, the demo register and the account preview run in your browser and write nothing to cookies or local storage.
- The sign-in session is the only entry we rely on. Without it, the dashboard cannot know who you are. The two sign-in entries are created by Supabase’s code, but they are stored under amynpos.com, and only our own pages can read them.
- Security token for forms. We do not use one today. Our website forms use a hidden spam-trap field instead, which stores nothing in your browser. The dashboard protects its forms with your sign-in session rather than a separate cookie. If we add a security token before launch, we will list it here first.
- Our host sets nothing either. Netlify, Inc., which hosts the website and receives the form entries, sets no cookie when it serves these pages. That includes cookies for load balancing and cookies that show different visitors different versions of a page. We use neither, and we re-check this before each release.
What we do not use
The following are absent from the website, the dashboard and the point of sale:
- Analytics cookies. We do not use a third-party analytics service. We do not count visitors with cookies or pixels.
- Advertising cookies. We run no ad network code and no retargeting pixel. We do not sell personal data and do not share it for advertising, so there is no advertising cookie to describe.
- Session recording. No service replays your mouse movements, scrolling or typing.
- Third-party cookies. No company other than Amyn and Supabase, Inc. stores anything in your browser through our pages. We load no social-media buttons, embedded videos or maps from other companies. The help assistant has its own section below.
- Industry opt-out tools. Some sites link to advertising-industry opt-out pages. We do not, because we take part in no interest-based advertising. There is nothing for those tools to switch off.
Why there is no cookie banner
Cookie banners exist to ask permission for cookies a site does not need in order to work, such as advertising and analytics cookies. We set none of those.
The sign-in session and the preference entry exist to provide something you asked for. You ask for a session by signing in. You ask for a preference by choosing it. Laws that require consent for cookies generally do not require consent for entries of this kind.
If that reading changes, or if we ever add a cookie that needs consent, we will add a clear way to say no before the cookie is set. Counsel: whether the sign-in session and the preference entry need consent to be settled with counsel, including any rules for visitors outside the United States.
Global Privacy Control and Do Not Track
Your browser can send a Global Privacy Control signal or a Do Not Track signal. We honour both. Because we do not sell personal data, share it for advertising or follow you across sites, these signals change nothing in practice. There is nothing left to switch off. Our privacy notice explains how we treat them.
The help assistant
The help assistant on the website is provided by Anthropic (model: Claude). It sets no cookie and keeps no identifier in your browser. Because it keeps nothing there, a chat does not carry over to your next visit. The help assistant cannot see your account or any data you keep with us. We keep chats for 30 days, to run and protect the service, and then delete them. We never use them to train AI models. Please do not enter card numbers, passwords or sensitive personal data into it. Our AI notice says more.
Other records that are not cookies
People sometimes ask about these because they feel like cookies. They are not, but they belong in a complete answer.
- Server logs. Every web host keeps short-lived logs of requests, including your IP address and browser type, to run and protect the service. These live on the server, not in your browser. Our privacy notice covers them.
- Policy acceptances. When you accept one of our policies in the dashboard, we record the policy version, the time, your IP address and your browser (user agent). This record lives on our server, not in your browser. The privacy notice explains it.
- Push notifications. If you turn on alerts in the dashboard, your browser keeps a permission record and a delivery address for those alerts. We keep a copy of that address on our server, because the alerts cannot be sent without it. You can withdraw the permission at any time in your browser’s settings or by turning alerts off in the dashboard.
- The browser’s own cache. Your browser may keep copies of our pages and images so they load faster. That is your browser’s behaviour, not something we control.
How to control cookies and local storage
You decide what stays in your browser. Its settings, usually under a heading like “Privacy” or “Site data”, show what each site has stored and let you remove it. From there you can:
- block all storage from amynpos.com;
- delete what is already there; or
- clear everything when you close the browser.
What happens if you block storage from amynpos.com:
- The website keeps working. It stores nothing there anyway.
- The dashboard will not keep you signed in. You may be returned to the sign-in page on every load, or be unable to sign in at all.
- Preferences you choose will not be remembered.
Clearing storage signs you out of the dashboard. It does not delete your Amyn account or any data you keep with us. To ask for that, see the privacy notice.
Some sites warn that third-party cookies accepted earlier may linger after you change a setting. We have never set one, so there is nothing from earlier visits to clean up.
The point of sale on registers, tablets and phones
The point of sale will keep a pairing key on the device so that it can sync sales with your account. That key identifies the device to Amyn and to no one else.
The point of sale will not use advertising identifiers, such as the ad ID that phone operating systems offer to app makers. It will not include advertising or analytics software from other companies. If it ever needs any other identifier, we will list it here before the point of sale ships.
Keeping this list current
This notice is a complete list on the date shown at the top. Before each release we check what our pages and apps store in the browser. If anything is added, changed or removed, we update the table and the “What changed” note.
How to contact us
Email info@amynpos.com or use the contact form on the website. Put “Cookies” in the subject line so we can route it. If you need this document in another format, ask us; our accessibility statement explains how we help. We will publish our mailing address here before launch. Every policy, with its version and effective date, is listed at /policies.
Tell us which page or app you are asking about, so we can answer precisely.
Changes to this document
Every version of this document carries a version number, an effective date and a “What changed” note. Earlier versions stay in an archive linked from /policies. If we make a material change, we email account holders at least 30 days before it takes effect. Smaller changes, such as fixing a typo or a link, take effect when posted. This is version 1.0, and no earlier version exists.
A material change to this notice is one such as a new cookie, a new entry in local storage or a new purpose for one. No change can reduce the protections promised here without that notice.