Cookie policy
Version 1.1 · Effective 23 October 2026
This policy explains how Epic House SIA uses cookies and similar technologies on https://clavy.io. It complements the Privacy policy and follows article 5(3) of the EU ePrivacy Directive (2002/58/EC) as transposed in Latvia, where Epic House SIA is established, and in the other EU and EEA countries where Clavy is used, including Spain (article 22.2 of Law 34/2002, LSSI-CE).
1. What cookies are
A cookie is a small text file that a website stores in your browser. This policy also covers the browser's local storage and similar technologies, which follow the same rules.
2. What we use
We use only storage that is strictly necessary to provide the Service you ask for or that remembers a choice you made. Under the ePrivacy rules this storage does not need your prior consent, so Clavy shows no cookie banner. We assess each item against the exemptions described in the cookie guidance of the Agencia Española de Protección de Datos (AEPD): strictly necessary storage, and the storage of a preference you chose. We use no advertising or cross-site tracking cookies, and our product analytics set no cookies (section 3).
The lists below cover everything Clavy sets in the browser of a visitor or of a signed-in user.
Cookies set by Clavy
| Name | Purpose | Duration |
|---|---|---|
better-auth.session_token (__Secure-better-auth.session_token on https) | Keeps you signed in | 30 days without use; renewed once a day while you use Clavy |
better-auth.session_data (with the __Secure- prefix on https) | Caches your session for a few minutes so that pages do not read the database on every request | 5 minutes |
CLAVY_LOCALE | Remembers the interface language you chose | 1 year |
sidebar_state | Remembers whether the workspace sidebar is open | 7 days |
Browser storage
| Key | Purpose | Duration |
|---|---|---|
theme | The light or dark theme you chose | Until you clear it |
clavy.location.session | Remembers that Clavy already checked your location permission in this sign-in, so that the check does not run on every page | Until you clear it; replaced at each sign-in |
clavy_analytics_opt_out | Remembers that you switched product analytics off, so that nothing is sent from this browser | Until you clear it or switch analytics back on |
3. Third parties
- Stripe: payment takes place on Stripe's checkout and billing portal pages, where Stripe sets its own cookies to process the payment and prevent fraud, under Stripe's policies.
- Google Maps: the interactive Google map and Google's 3D view load only when you click to open them. From then on Google receives your IP address and may store or read information in your browser under its own policies.
- Product analytics: Clavy's pages tell our analytics provider, PostHog (hosted in the EU), which pages you view and which actions you take, through Clavy's own address. Nothing is stored in your browser for this: while you are signed in the events carry your account identifier; otherwise PostHog derives an anonymous identifier that changes every day from the request on its servers. PostHog discards your IP address. You can switch product analytics off on your account page; the switch is remembered in your browser (
clavy_analytics_opt_out). - Aerial imagery: your browser loads aerial images directly from the Instituto Geográfico Nacional (www.ign.es and tms-pnoa-ma.idee.es), which receive your IP address.
4. How to control cookies
You can delete or block cookies in your browser's settings. Blocking Clavy's session cookie stops you from signing in; deleting the other items only resets the choices they remember.
5. Verifying this list
This list is checked against Clavy's code in automated tests, and it is reviewed whenever a cookie or a storage key is added or removed.
6. Changes
We update this policy whenever we add, change or remove a cookie, with a new version and effective date on this page. For questions, write to privacy@clavy.io.