Cookie Policy
Surprilo deliberately uses the minimum set of cookies required to provide the service. All cookies listed below are set by surprilo.com itself (first-party), are HttpOnly and are never used for advertising, profiling or cross-site tracking.
Because every mechanism below is strictly necessary to provide a service you explicitly requested (or to protect the service from abuse), no cookie consent banner is shown. You may still block or delete cookies in your browser; the affected features will stop working.
| Cookie | Purpose | Duration | Category | Necessary |
|---|---|---|---|---|
| surprilo_sid | Identifies your anonymous creator session so drafts and experiences you create remain yours ("My experiences"). Random opaque identifier, HttpOnly, set by the server. | 180 days | First-party, functional | Yes — anonymous creation flow |
| surprilo_aid | Anonymous recipient funnel identifier. Protects interactions against abuse (rate limiting) and groups anonymous analytics events. Random opaque identifier, HttpOnly. | 30 days | First-party, security/functional | Yes — abuse protection |
| sb-…-auth-token (and related sb- cookies) | Keeps you signed in (authentication session) and protects the login flow against tampering. Managed by our authentication provider, HttpOnly. | Session / managed by our authentication provider | First-party, authentication | Yes — account sign-in |
What we do NOT use
- No advertising cookies and no cross-site advertising tracking;
- no Google Analytics (GA4), no Google Tag Manager;
- no Meta Pixel, TikTok Pixel or any other marketing trackers;
- no session replay, heatmaps or fingerprinting;
- no localStorage, sessionStorage or IndexedDB identifiers.
Third-party content
Creators may embed YouTube videos in their experiences. When you play such a video, YouTube may set its own cookies and process your data under Google's privacy policy — Surprilo cannot prevent third-party providers from setting cookies on their own content once you interact with it. Playback is user-initiated and does not happen on page load.
Attribution between recipients and new creators is handled entirely server-side: no cookie, URL parameter or browser storage is used for it.
Managing cookies
You can delete or block cookies in your browser settings at any time. Blocking `surprilo_sid` means anonymous drafts cannot be tied to your browser; blocking authentication cookies means you cannot stay signed in.
If you have questions about cookies or this policy, contact contact@surprilo.com.