Legal
Cookie Policy
Last updated September 2026
1. How PaperWorking Uses Cookies & Local Storage
PaperWorking uses strictly necessary first-party HTTP-only cookies and browser local storage to authenticate sessions, enforce multi-tenant workspace boundaries, protect against Cross-Site Request Forgery (CSRF), and preserve underwriting calculator preferences. We do not use third-party behavioral advertising cookies or cross-site tracking pixels.
2. Essential First-Party Cookies (Strictly Necessary)
The following first-party cookies are required for core platform authentication and security:
__session (Authentication & Session Integrity)
An HTTP-only, cryptographically signed session token issued upon sign-in via Firebase Authentication and verified by PaperWorking edge middleware. Used to authenticate API requests and dashboard navigation.
__acct (Account Role & Workspace Routing)
Stores the authenticated account role (Investor, Investment Team, Vendor, or Admin) so edge middleware can route requests to the appropriate workspace shell without unnecessary database round-trips.
__sub (Subscription & Trial Entitlement State)
Tracks active subscription or 14-day free trial status so workspace features and marketplace permissions are enforced consistently across client and server routes.
3. Functional & Workspace Preference Storage
PaperWorking uses first-party browser storage (localStorage and sessionStorage) to keep your workspace responsive and prevent data loss during active sessions. This includes saving in-progress Deal Calculator underwriting inputs, remembering your selected theme or table/grid view mode in the Deals Marketplace, and storing recently viewed projects.
4. Third-Party Security & Payment Tokens
When you interact with specific security or payment workflows, trusted service providers may set scoped functional cookies or tokens:
Cloudflare Turnstile (Bot & Abuse Defense)
Public forms such as Support Call-Back requests and authentication endpoints use Cloudflare Turnstile challenge tokens to block automated abuse without invasive tracking.
Stripe, Inc. (Checkout & Billing Portal)
When you start a subscription checkout or open the billing portal, Stripe sets security cookies necessary to process PCI-DSS compliant payments and detect payment fraud.
Google Maps & Places (Address Autocomplete)
Address lookup requests use short-lived session tokens to group autocomplete keystrokes with final place detail resolution.
5. Managing & Clearing Cookies
Signing out of PaperWorking immediately clears your active __session, __acct, and __sub cookies. You can also clear or block cookies at any time through your browser settings. Please note that blocking strictly necessary first-party cookies will prevent you from signing in to the PaperWorking dashboard.