Last updated: value to be confirmed: [EFFECTIVE DATE]
1. Who we are and what this policy covers
1.1 This policy covers cookies and similar technologies on the marketing site at daybeat.io and the app at my.daybeat.io, operated by Function 365 Limited, trading as Daybeat, company number 10069330, registered office Third Floor, 95 The Promenade, Cheltenham, Gloucestershire, United Kingdom, GL50 1HH.
1.2 Our Privacy Notice at /privacy explains how we handle personal data more generally. Contact us at info@function365.co.uk about this policy.
2. Definitions
2.1 Daybeat means our service, including the marketing site and app described in clause 1.1.
2.2 Privacy Notice means our notice about handling personal data, linked in clause 1.2.
3. What cookies and similar technologies are
3.1 A cookie is a small text file stored by your browser and sent back to the relevant website on later requests.
3.2 First-party cookies come from the site you visit, third-party cookies come from another organisation through that site, and persistent cookies remain until they expire or you delete them.
3.3 Similar technologies, including local storage, keep information in your browser for the website to use and are also covered by this policy.
4. The marketing site
4.1 The marketing pages at daybeat.io set no cookies, run no analytics and load no tracking script.
4.2 Its only visitor-facing third-party request is for Google Fonts, loaded from fonts.googleapis.com and fonts.gstatic.com. Your IP address and browser user agent reach Google when the fonts are requested; this does not set a cookie. drafting note: [OPEN: self-host via next/font and delete this paragraph.]
4.3 The app's authentication and referral functions are described separately below. The statement in clause 4.1 concerns the marketing pages, not those app functions.
5. Cookies in the app
5.1 The table describes authentication cookies used during sign-in and app use, a staff-only support cookie, and the referral cookie set when you arrive through a referral link, which can happen before sign-in. Authentication cookie names below are the production names, including the __Secure- prefix.
| Name | Set by | Purpose | Lifetime | Type |
|---|---|---|---|---|
__Secure-daybeat.session_token | Daybeat through its self-hosted Better Auth library | Maintain your signed-in session and identify your account | 30-day session, refreshed at most every 24 hours | First-party; persistent; strictly necessary; HttpOnly, SameSite=Lax, Secure; Path=/; Domain: host-only |
__Secure-daybeat.dont_remember | Daybeat through Better Auth | Record that you did not ask to be remembered, so the session is not extended | Session cookie, with no Max-Age | First-party; strictly necessary; HttpOnly, SameSite=Lax, Secure; Path=/; Domain: host-only |
__Secure-daybeat.trust_device | Daybeat through its authentication library's two-factor function | Remember a device you choose to trust, so the two-factor challenge can be skipped on that device | 30 days. For Daybeat staff the trust is re-challenged after 7 days by a server-side record, even though the cookie itself carries the longer expiry | First-party; persistent; strictly necessary for the security function you choose; HttpOnly, SameSite=Lax, Secure; Path=/; Domain: host-only |
__Secure-daybeat.two_factor | Daybeat through its authentication library | Carry the half-completed sign-in while you enter your two-factor code | 10 minutes | First-party; persistent; strictly necessary; HttpOnly, SameSite=Lax, Secure; Path=/; Domain: host-only |
__Secure-daybeat.admin_session | Daybeat through its authentication library's staff support function | Support a read-only session in a customer's workspace; set only on a Daybeat staff device, never on a customer device | 30-day cookie Max-Age; the read-only support session itself is capped at 1 hour | First-party; strictly necessary for staff support access; HttpOnly, SameSite=Lax, Secure; Path=/; Domain: host-only |
daybeat_ref | Daybeat's referral landing route | Carry a referral token to checkout so a referral can be credited | 30 days, or until checkout resolves it if sooner | First-party; persistent; referral attribution, not strictly necessary; HttpOnly, SameSite=Lax, Secure on HTTPS; Path=/; Domain: host-only |
5.2 drafting note: [OPEN: Check the library-verified cookie names, purposes, lifetimes and attributes in this table against live production responses before publication, including two-factor and staff support flows; confirm the host-only scope and complete the outstanding lifetime checks.]
5.3 The 30-day session lifetime in the table is the customer session lifetime when remembered. Daybeat staff sessions are capped at 12 hours. Signing out ends your session. Cookie and session expiry do not mean that server records are deleted.
5.4 HttpOnly prevents browser scripts from reading a cookie; Secure restricts its transmission to HTTPS; SameSite=Lax limits when it is sent with requests from another site. Path=/ makes the cookie available across paths on its host. Cookies are host-only: no cross-subdomain cookie is configured.
5.5 The referral cookie contains a referral token and is set only when you arrive through a referral link. It is not needed to stay signed in. It is deleted as soon as checkout resolves it, whether or not the referral is credited. drafting note: [OPEN: PECR regulation 6, consent may be required for daybeat_ref; no consent banner exists today. Obtain the solicitor's ruling and resolve any required consent mechanism before publication.]
5.6 We do not set a CSRF cookie: we use Origin header checks to help protect browser requests against cross-site request forgery. We do not set a theme or preference cookie.
5.7 We do not set Stripe cookies on our domain. Checkout takes place on Stripe's own domain, under Stripe's cookie notice, as described in section 7.
5.8 On a non-HTTPS development origin, the session cookie is named daybeat.session_token; production authentication cookies carry the __Secure- prefix shown above. The referral cookie is set separately and retains the bare name daybeat_ref. The authentication cookies session_data and account_data are not in use because the session cookie cache is off.
6. Local storage
6.1 The app uses two first-party local storage key patterns for interface state. Neither holds credentials or session data, and neither is used for tracking.
6.2 daybeat-piece-draft:${actorUserId}:${pieceId}:${currentVersionId} saves an in-progress draft of a piece you are editing so a refresh does not lose your edits. The key includes your user id, the piece id and its version id; the stored value is your draft content. It is cleared on cancel, discard and version change.
6.3 daybeat.billing-banner.dismissed.${tenantId}.${kind} records that you dismissed a billing banner in your workspace.
6.4 drafting note: [OPEN: Confirm the billing-banner key's retention and clearing behaviour, and whether any additional expiry applies to saved drafts; no fixed local storage lifetime is established in the supplied facts.]
6.5 We do not use session storage. drafting note: [OPEN: Confirm the PECR regulation 6 treatment of each local storage purpose, including any applicable exception or required consent; do not infer exemption merely because storage is first-party or does not track people.]
7. Third-party cookies and services
7.1 We do not set third-party cookies through Daybeat. We do not use advertising, retargeting or profiling cookies, social media tracking pixels or embedded third-party trackers.
7.2 When you use Stripe Checkout or Stripe's billing portal, Stripe's own cookie notice applies to its services and any cookies it sets on its own domain.
7.3 Platforms you authorise through a connection have their own privacy and cookie notices, which govern your use of their services.
7.4 We do not share cookie data with advertising networks or data brokers, or sell information collected through cookies.
8. How to control cookies and local storage
8.1 Most browsers allow you to inspect, block or delete cookies using browser settings, including settings for individual sites.
8.2 If you block authentication cookies from my.daybeat.io, you cannot stay signed in to the app. Blocking cookies only from the marketing host daybeat.io does not by itself block the app's sign-in cookies.
8.3 Deleting the referral cookie does not affect your account or use of the service, but may prevent the referral from being credited.
8.4 drafting note: [OPEN: Confirm browser site-data instructions for clearing the two local storage keys and the resulting effect on unsaved edits and dismissed billing banners before adding customer instructions.]
9. Changes and contact
9.1 We may update this policy. The last-updated date at the top identifies the current policy. We will update this policy before introducing cookies that require consent.
9.2 Contact info@function365.co.uk, or write to Function 365 Limited at Third Floor, 95 The Promenade, Cheltenham, Gloucestershire, United Kingdom, GL50 1HH.
9.3 Our terms at /terms set out the law of England and Wales and the exclusive jurisdiction of the courts of England and Wales for the service.
9.4 drafting note: [OPEN: Solicitor to check the brief's reference to the Data (Use and Access) Act 2026, including the correct statutory citation, commencement and any effect on this policy; no position is asserted.]
9.5 drafting note: [OPEN: Review PECR alongside the UK GDPR and Data Protection Act 2018, including whether the business-only customer model affects the position for sole traders, partnerships and other visitors; do not assume that it removes cookie or local storage protections.]