Cookies are small text files stored on your device when you visit a
website. They serve various purposes such as keeping you logged in,
remembering preferences, and protecting against cross-site attacks.
Not all cookies are the same. Functional cookies are
strictly necessary for a website to work properly. Tracking cookies follow your behavior across websites for advertising
purposes. These two categories are treated very differently under Dutch and
European law.
2. Cookies we use
deploybase uses only functional cookies that are strictly necessary
for the platform to work. We use the minimum number of cookies required.
Cookie
Purpose
Type
Duration
authjs.session-token
Keeps you logged in. Contains your encrypted session so you don't
have to sign in on every page.
Functional
30 days
authjs.csrf-token
Protects against cross-site request forgery (CSRF) attacks. Ensures
that form submissions come from our site, not a malicious third
party.
Functional
Session
authjs.callback-url
Temporarily stores the page you were visiting before logging in, so
you can be redirected back after authentication.
Functional
Session
authjs.pkce.code_verifier
Used during sign-in to secure the authentication exchange (PKCE).
Prevents authorization code interception attacks.
Functional
Session
authjs.state
Protects the sign-in flow against cross-site request forgery by
verifying the authentication response matches the original request.
Functional
Session
authjs.nonce
Ensures the identity token received after sign-in was issued
specifically for this authentication request. Prevents replay
attacks.
Functional
Session
__Host-deploybase_login_session
Remembers where you are in signing in (the email you entered, the
step you are on) between the steps of the sign-in form. Signed, so
it cannot be altered, and it stops working after 10 minutes even if
someone copies it.
Functional
10 minutes
__Host-signup_next
Remembers where to take you once your new account is ready, for
example straight back to the project you were setting up.
Functional
1 hour
__Host-login_banner
Carries a one-line notice, such as "You're signed out.",
to the sign-in page.
Functional
2 minutes
__Host-login_return
Remembers the page you were on when your session ended, so signing
in takes you back there.
Functional
2 minutes
__Host-login_error
Carries the reason a sign-in with another provider failed to the
sign-in page.
Functional
2 minutes
__Host-login_restarted
Lets a sign-in that cannot finish restart once, so it never repeats
in a loop.
Functional
1 minute
__Host-deploybase_sso_redirect
Remembers which team's single sign-on page you opened while sign-in
starts.
Functional
2 minutes
__Host-deploybase_pending_active_team
Opens the team you just signed in to with single sign-on.
Functional
5 minutes
deploybase_step_up_grant
Set only while you change your account email. Holds the encrypted
proof that you just confirmed it's you, so the change can go ahead.
Functional
Up to 10 minutes
deploybase_step_up_passkey
Set only while you change your account email. Holds the encrypted
sign-in check your passkey answers, between the prompt and your
answer.
Functional
5 minutes
deploybase_step_up_idp
Set only while you change your account email. Remembers which
linked provider you went to confirm it's you, so we only accept the
return of a check you started.
Functional
10 minutes
db_sidebar
Remembers whether you collapsed the app's sidebar.
Functional
1 year
db_projects_view
Remembers whether you view your projects as a grid or a list.
Functional
1 year
db_form_view_{form}
Remembers how you view one form's submissions.
Functional
1 year
db_preview_hint_{project}
Remembers that you dismissed the suggestion to make one project's
previews team only.
Functional
1 year
Every cookie our servers set is HttpOnly (not accessible
to JavaScript), Secure (only sent over HTTPS), and SameSite (not sent with cross-site requests). These settings provide the strongest protection
against cookie theft and cross-site attacks. In production, the sign-in cookies
are prefixed with __Secure- (e.g., __Secure-authjs.session-token) to enforce the browser's
HTTPS-only constraint at the cookie name level.
The cookies above that start with __Host- go one step
further. Your browser only accepts a cookie with that prefix from app.deploybase.eu itself, over HTTPS, for the whole site.
That matters because the sites our customers host live under deploybase.eu too: the prefix means none of them can place a cookie
that our sign-in pages would read.
The three db_ cookies are the exception: the page itself sets them, so they
are not HttpOnly, and they hold only a layout choice.
3. No tracking cookies
deploybase does not use:
Advertising or marketing cookies
Third-party analytics that track individual users
Social media tracking pixels
Fingerprinting or any other cross-site tracking technology
For usage statistics we run our own Umami instance, which we host
ourselves in the EU. It sets no cookies and honours your browser's Do Not
Track setting. Inside the app it counts per team, using a keyed hash of
the team's id, and never per person. Visitors who do not sign in are never
identified.
Because we only use functional cookies, no cookie consent banner is required under the Dutch Telecommunicatiewet and the ePrivacy Directive. You do not need
to accept or reject cookies to use deploybase.
4. Third-party cookies
deploybase does not load any third-party scripts that set cookies. Our
authentication provider (Zitadel) is self-hosted on our own
infrastructure, so no cookies are shared with external identity providers.
Sites hosted on deploybase (*.sites.deploybase.eu) are served
via Bunny.net CDN. Bunny.net does not set tracking cookies on
CDN-delivered content.
5. Managing cookies
You can delete or block cookies through your browser settings. However,
because our cookies are strictly functional, disabling them will prevent
you from logging in and using the platform.
Most browsers allow you to manage cookies through:
Settings → Privacy & Security → Cookies (varies by browser)
Developer Tools → Application → Cookies to inspect
individual cookies
6. Legal basis
Under Article 11.7a of the Dutch Telecommunicatiewet (implementing the EU
ePrivacy Directive), cookies that are strictly necessary for a service explicitly requested by the user are exempt from the consent requirement.
All cookies used by deploybase fall under this exemption. They are
necessary for authentication and security — core functions that you
explicitly request when you sign in.
For more details on how we handle your personal data, see our Privacy Policy.
7. Changes to this policy
If we start using non-functional cookies in the future, we will update
this policy and implement a cookie consent mechanism that meets the
requirements of the Telecommunicatiewet and GDPR. You would be asked for
explicit consent before any non-essential cookies are placed.