Legal

Cookie Notice

Superbloo uses cookies to keep you signed in, measure product usage and, with your permission, reconstruct sessions for debugging. This page explains what is collected, why, and how to change your choice.

Last updated October 12, 2026

01What each category covers

1.1 Strictly necessary

Session cookies set by our authentication provider (Better Auth) keep you signed in and identify which workspace you are working in. Asidebar_state cookie remembers whether you collapsed the app sidebar. None of these are used for advertising or shared with anyone, and the product cannot function without them, so they are not optional.

1.2 Product analytics

We use PostHog to understand which features are used, where people get stuck, and whether a change made things better or worse. This sets a first-party identifier that lets us tell a returning visitor from a new one and connect your visits into a single history.

Until you have made a choice (see section 02) analytics runs from memory only: no identifier is written to your browser, so each visit looks like a new visitor. The installed desktop application sends product analytics and first-party usage records unless you turn “Usage analytics” off under Settings → Privacy.

We also use DataFast to measure which sources bring visitors and which visits lead to a sign-up or paid plan. It sets two first-party cookies, datafast_visitor_id and datafast_session_id, and records page views. When you are signed in it receives only an opaque account id, never your name or email; payments are reported from our servers with the amount and a processor customer id. DataFast is loaded only after you allow analytics (section 02), is never loaded on review-link or invitation pages, and the cookies are deleted if you later turn analytics off. Without your permission it does not run and no DataFast cookie is set.

On our marketing pages we additionally use Cloudflare Web Analytics, a cookieless page-view counter that stores nothing on your device.

Analytics requests are served from our own domain rather than a third-party one. That is a deliberate reliability choice, not an attempt to evade blocking: browser privacy protections shorten the lifetime of identifiers set by third-party scripts, which would make a returning visitor indistinguishable from a new one after a week.

1.3 Session replay

Session replay reconstructs the clicks, scrolls, and navigation of a session so we can see what happened in the run-up to an error rather than guessing from a stack trace. It records the structure of the page, not a video of your screen.

Replay is masked and opt-inWeb replay records only after you allow it (section 02). It masks every input field, blocks every video, image and canvas element, and replaces all visible text with placeholders everywhere inside the signed-in app (including Bloo conversations, captions, transcripts, file and project names) and on sign-in, billing and review pages. Only public marketing pages are recorded with readable text. Desktop replay is off by default and, when you turn it on under Settings → Privacy, masks every input, every piece of text and every media element. Credentials, authorization data, storage keys and local filesystem paths are excluded everywhere.

02Your choice

If you are visiting from the EU/EEA, the United Kingdom or Switzerland — or we cannot tell where you are — a banner asks before we store an analytics identifier, load DataFast or record session replay; until you choose, none of these run. Elsewhere analytics (PostHog, DataFast) with a stored identifier and masked replay apply by default. Either way you can change your mind here at any time; the change applies immediately in this browser.

03Operational records

Credits consumed, generations and exports run, storage used, and subscription events are recorded on our servers as part of providing and billing the Services, on the contractual and legitimate-interest bases set out in section 04 of our Privacy Policy. That data is tied to your account rather than to a cookie.

Errors and crashes are also reported to Sentry because keeping the product working is a legitimate interest and the reports are scrubbed of personal content before they are sent.

04Clearing cookies

You can delete Superbloo cookies at any time from your browser settings. Deleting the session cookie signs you out. Analytics may create a new pseudonymous identifier on your next visit.

05Questions

For anything cookie- or privacy-related, email privacy@superbloo.com. The full picture of what we collect and why is in our Privacy Policy, and the vendors involved are listed on our Subprocessors page.