Cookie Policy
How BossPaws uses cookies and similar tracking technologies.
Last Updated: April 9, 2026
This Cookie Policy explains how FlexPilot Inc., doing business as BossPaws™ ("BossPaws," "we," "us," or "our"), uses cookies and similar tracking technologies across our platforms. This policy should be read alongside our Privacy Policy.
What Are Cookies?
Cookies are small text files placed on your device by websites you visit. They are widely used to make websites function properly, remember your preferences, and provide analytics information to website operators.
Similar technologies include local storage, session storage, pixels, web beacons, and device identifiers, which serve comparable purposes. In this policy, we use "cookies" to refer to all such technologies unless otherwise specified.
Our Approach to Cookies
We believe in using the minimum tracking necessary for each context. Our approach differs by platform:
- Marketing site (bosspaws.ai): Uses analytics cookies that require your consent before being set.
- Web application (app.bosspaws.ai): Uses only essential cookies for authentication. Analytics are cookieless. No consent banner is needed.
- Mobile apps (iOS/Android): Use device-native secure storage. No browser cookies are used.
Marketing Site (bosspaws.ai)
Our marketing website uses cookies for analytics purposes. These cookies are set only after you provide consent through our cookie consent banner, in compliance with Quebec's Law 25 (Act respecting the protection of personal information in the private sector) and Canadian privacy law best practices.
Cookie Consent on the Marketing Site
When you first visit bosspaws.ai:
- A cookie consent banner is displayed with clear "Accept All" and "Reject All" options of equal visual prominence.
- You may also customize your preferences by category (Necessary, Analytics).
- No analytics cookies are set until you actively provide consent. Google Analytics and Microsoft Clarity scripts are loaded only after you click "Accept All" or enable Analytics cookies in the preferences.
- If you click "Reject All" or close the banner without consenting, no analytics cookies are set and your browsing behavior is not tracked by third-party analytics tools.
- You can change your consent preferences at any time using the "Cookie Settings" link in the website footer.
- Your consent preference is stored in a strictly necessary cookie so you are not asked again on each visit.
Strictly Necessary Cookies (Always Active)
These cookies are essential for the website to function. They do not require your consent and cannot be disabled.
| Cookie | Purpose | Duration | Provider |
|---|---|---|---|
cookie_consent | Stores your cookie consent preferences | 12 months | bosspaws.ai (first-party) |
Analytics Cookies (Require Consent)
These cookies help us understand how visitors interact with our marketing site. They are set only if you consent.
Google Analytics 4:
| Cookie | Purpose | Duration |
|---|---|---|
_ga | Distinguishes unique visitors by assigning a randomly generated identifier | 2 years |
_ga_[ID] | Maintains session state for Google Analytics | 2 years |
_gid | Distinguishes unique visitors (short-term) | 24 hours |
_gat | Throttles request rate to Google Analytics | 1 minute |
Google Analytics 4 is configured with IP anonymization enabled. Data is processed by Google LLC under our data processing agreement. For more information, see Google's Privacy Policy.
We implement Google Analytics with Consent Mode v2, which means:
- Before consent: GA4 operates in a restricted mode, sending only cookieless pings for basic measurement. No cookies are set.
- After consent: Full GA4 functionality is enabled, including the cookies listed above.
Microsoft Clarity:
| Cookie | Purpose | Duration |
|---|---|---|
_clck | Persists the Clarity user ID for the site | 1 year |
_clsk | Connects multiple page views by a user into a single session | 1 day |
CLID | Identifies the first time Clarity encounters a user | 1 year |
ANONCHK | Indicates whether MUID cookie data is transferred to ANID | Session |
MR | Checks whether to refresh MUID | 7 days |
SM | Used to synchronize the MUID across Microsoft domains | Session |
Microsoft Clarity records page interactions (clicks, scrolls, mouse movements) to generate heatmaps and session insights. Sensitive content areas are masked — Clarity does not record the content of forms, personal data fields, or health-related information displayed on our pages. Data is processed by Microsoft Corporation. For more information, see Microsoft's Privacy Statement.
Web Application (app.bosspaws.ai)
Our web application uses a minimal, privacy-first approach. We use only essential cookies required for the Service to function, and completely cookieless analytics.
Essential Cookies (No Consent Required)
These cookies are strictly necessary for the Service to function. Without them, you cannot log in to or use BossPaws. Under PIPEDA, Quebec Law 25, and CCPA/CPRA, strictly necessary cookies do not require consent.
| Cookie | Purpose | Duration | Provider |
|---|---|---|---|
sb-[ref]-auth-token | Supabase authentication session — keeps you securely logged in | Session / up to 7 days | Supabase (first-party, set on app.bosspaws.ai) |
sb-[ref]-auth-token-code-verifier | PKCE authentication flow verification — ensures secure login handshake | Session | Supabase (first-party) |
These cookies are set with the Secure, HttpOnly, and SameSite attributes for maximum security.
Analytics (Cookieless — No Consent Required)
We use PostHog in cookieless mode for product analytics on the web application. In this configuration:
- No cookies are placed on your device.
- No persistent identifiers are stored in your browser (no local storage, no session storage, no fingerprinting).
- Analytics data is collected using anonymous, non-persistent session identifiers that are discarded at the end of each page view.
- Individual users cannot be identified or tracked across sessions.
- Data collected includes: anonymized page views, feature usage events, and interaction patterns.
Because no cookies or persistent tracking technologies are used for analytics on the web application, no cookie consent banner is displayed on app.bosspaws.ai.
Mobile Applications (iOS and Android)
Our native mobile applications do not use traditional browser cookies.
- Authentication tokens are stored securely using device-native secure storage mechanisms (iOS Keychain / Android Keystore), not browser cookies.
- Analytics data is collected via the PostHog SDK using anonymous, non-persistent identifiers. No cookies are set.
- No cookie consent mechanism is applicable to native mobile applications.
Your Choices and Controls
Managing Marketing Site Cookies
- Consent banner: When you first visit bosspaws.ai, use the cookie consent banner to accept or reject analytics cookies.
- Change preferences: Click the "Cookie Settings" link in the marketing site footer at any time to update your choices.
- Browser settings: You can also configure your browser to block or delete cookies. See instructions below.
Browser-Level Cookie Controls
Most browsers allow you to view, delete, and manage cookies:
| Browser | Instructions |
|---|---|
| Google Chrome | Settings > Privacy and Security > Third-party cookies |
| Apple Safari | Preferences > Privacy > Manage Website Data |
| Mozilla Firefox | Settings > Privacy & Security > Cookies and Site Data |
| Microsoft Edge | Settings > Cookies and Site Permissions > Manage and delete cookies |
Web Application Cookies
The Supabase authentication cookies on app.bosspaws.ai are strictly necessary for the Service to function. If you block or delete these cookies, you will be logged out and unable to use BossPaws. These cookies cannot be opted out of while using the Service.
Global Privacy Control (GPC)
We honor the Global Privacy Control (GPC) browser signal. If your browser sends a GPC signal (Sec-GPC: 1 header or navigator.globalPrivacyControl):
- On our marketing site: We treat it as a rejection of analytics cookies and do not load Google Analytics or Microsoft Clarity.
- On our web application: No action is needed, as no tracking cookies are used.
This is in compliance with the California Consumer Privacy Act (CCPA/CPRA) and applicable state privacy laws that require honoring universal opt-out mechanisms.
Do Not Track (DNT)
Some browsers send a "Do Not Track" (DNT) signal. There is currently no universal standard for how websites should respond to DNT signals.
- Our marketing site respects your cookie consent preferences and GPC signals regardless of DNT.
- Our web application does not use tracking cookies, making DNT not applicable.
Third-Party Cookies
We do not allow any third-party advertising cookies on any of our platforms. The only third-party services that may set cookies are:
- Google Analytics 4 (marketing site only, with consent) — analytics cookies as listed above.
- Microsoft Clarity (marketing site only, with consent) — analytics cookies as listed above.
No third-party advertising networks, social media pixels, or retargeting services operate on any BossPaws platform.
Changes to This Cookie Policy
We may update this Cookie Policy from time to time to reflect changes in the cookies we use, the technologies available, or applicable laws. When we make changes:
- We will update the "Last Updated" date at the top of this policy.
- For material changes, we will reset your cookie consent preferences so you can review and consent to the updated cookie usage.
- We will provide notice of significant changes through the affected platforms.
Contact Us
If you have questions about our use of cookies or this Cookie Policy, please contact us:
- Privacy Officer: [email protected]
- General support: [email protected]
This Cookie Policy is effective as of the "Last Updated" date above.