A small, deliberate cookie surface.
Workacross names the small amount of browser storage it uses and gives you a direct choice about optional measurement.
Owner official-source compliance review: no counsel. This is not legal advice or a guarantee against every claim.
Stored to remember your choice
Workacross stores one strictly necessary first-party cookie named frontiers.analytics-consent. Its value pairs the current consent-text version with your choice, for example 2026-08-v1:accepted, so a wording change invalidates an earlier choice. The cookie lasts for six months and remembers your measurement choice so the banner does not return on every route; after six months the choice is asked again, including after a refusal. The cookie is readable on the server request and contains no identifier.
Stored only after acceptance
If you accept measurement, the browser may store frontiers.analytics.session in localStorage. It is a random session identifier used to group the allowlisted product events sent to /api/analytics. It remains until you withdraw consent or clear browser storage; Workacross does not set an automatic expiry. No analytics key is created for a visitor who has not accepted.
Strictly necessary sign-in storage
For passwordless email, frontiers_return_to stores the same-origin return page for one hour. Social sign-in adds short-lived frontiers.auth-intent, frontiers.auth-feedback, and frontiers.auth-next cookies for the provider choice, safe return path, one-time status, and profile step; they expire within ten minutes and are cleared after use. Supabase Auth stores its first-party session and PKCE cookies for up to 400 days. Cloudflare Turnstile loads only with the email method and may use strictly necessary browser storage to verify the request. None of this is analytics, and declining measurement does not sign you out.
Nothing else is used for measurement
Workacross does not load advertising cookies, retargeting pixels, affiliate tracking scripts, or unapproved analytics vendors. Speed Insights loads on every visit for aggregated performance data; it sets no cookie and stores nothing in your browser. Vercel Web Analytics is not used. When you accept measurement, the custom product-event counter begins counting allowlisted, sanitized events; event metadata does not contain message text, email addresses, or private profile fields.
Storage owner, category and activation
frontiers.analytics-consent, Workacross; necessary; consent version and accept/refuse choice; 6 months; set only when a choice is made. frontiers.analytics.session, Workacross localStorage; optional measurement; random session grouping; until withdrawal/browser clearing; created only after acceptance. frontiers_return_to: Workacross; necessary; safe sign-in return; 1 hour; set on email auth. frontiers.auth-intent, frontiers.auth-feedback and frontiers.auth-next, Workacross; necessary; auth flow state; at most 10 minutes; social auth. frontiers.signup-pending, Workacross sessionStorage; necessary; same-tab code flow; at most 60 minutes. Supabase session/PKCE cookies: Supabase; necessary; authentication; configured up to 400 days. Turnstile storage: Cloudflare; necessary anti-abuse; email method only.
