Cookie policy
Last updated: 5 November 2026
1. What are cookies?
Cookies are small text files stored on your device by your web browser. They help websites remember information about your visit, such as whether you are signed in. We use only the cookies the platform needs to work, plus one that remembers your language.
UK law (the Privacy and Electronic Communications Regulations) lets a website use cookies like these without asking first, because they are needed for the service you have asked for. That is why StableSync has no cookie banner. If we ever add a cookie that isn't needed, we will ask you before setting it.
We do not use any advertising, analytics, or third-party tracking cookies.
2. Cookies we use
Strictly necessary cookies
These cookies are essential for the platform to function. They cannot be disabled. Without them, you would not be able to sign in, sign up or use StableSync.
| Cookie name | Purpose | Duration | Type |
|---|---|---|---|
| __Secure-authjs.session-token | Keeps you signed in and says which yard you belong to. Its contents are encrypted. | 7 days, or until you sign out | First-party, Secure, HttpOnly |
| __Secure-authjs.callback-url | Remembers the page to take you back to after you sign in. | Until you close your browser | First-party, Secure, HttpOnly |
| __Host-authjs.csrf-token | Stops another website from sending requests in your name while you sign in. | Until you close your browser | First-party, Secure, HttpOnly |
| google_oauth_state | Protects Google sign-in from being started by another website. | 10 minutes, deleted after sign-in | First-party, Secure, HttpOnly |
| facebook_oauth_state | Protects Facebook sign-in from being started by another website. | 10 minutes, deleted after sign-in | First-party, Secure, HttpOnly |
| oauth_signup_data | Holds the name and email Google or Facebook gave us, to fill in the sign-up form. | 10 minutes | First-party, Secure, HttpOnly |
| oauth_signup_proof | Confirms you signed in with Google or Facebook, so you can create a yard without a password. | 30 minutes, deleted when the yard is created | First-party, Secure, HttpOnly |
| signup_email_code | Links the code we email you to this browser while you create a yard. | 15 minutes, deleted when the yard is created | First-party, Secure, HttpOnly |
| ss_central_proof | Remembers that you just signed in on stablesync.app, so you can choose which yard to open. | 10 minutes | First-party, Secure, HttpOnly |
| ss_admin_session | Keeps StableSync's own staff signed in to the platform admin console. Never set for yard users. | 8 hours | First-party, Secure, HttpOnly |
Preference cookie
This cookie remembers a choice you made, so you don't have to make it on every visit.
| Cookie name | Purpose | Duration | Type |
|---|---|---|---|
| NEXT_LOCALE | Remembers the language you chose (English, French or Spanish). Set when you pick a language or sign in. | 1 year | First-party |
3. Local storage and service worker
Besides cookies, StableSync stores some things in your browser (local storage, IndexedDB and a service worker) so it works like an app on your phone:
- Offline copies: so the app keeps working when your signal drops, it keeps a copy on your device of the screens you have opened (tasks, horses, the feed board and the rug guide). These copies can include your yard's records. Only the person who opened them can see them; they are deleted when you sign out, when your session ends, or when someone else signs in on the same device.
- Changes made offline: anything you record without signal is kept on your device until it can be sent to StableSync, then removed.
- Preferences: small settings such as banners and tips you have dismissed, the columns and favourites you chose in the feed catalogue, and whether you have seen the demo tour. These stay on your device and are not sent to us.
- Push notifications: if you turn them on, your browser gives us an address to send notifications to, which we keep on our server. You can turn them off at any time in your browser settings or in StableSync's notification settings.
4. Third-party cookies
StableSync does not set any third-party cookies. We do not use Google Analytics, Facebook Pixel, or any other analytics or advertising trackers.
During the Google or Facebook sign-in flow, those services may set their own cookies on their respective domains (google.com, facebook.com). These are governed by Google's Privacy Policy and Meta's Privacy Policy respectively, not by StableSync.
5. Managing cookies
You can control and delete cookies through your browser settings. Most browsers allow you to:
- View what cookies are stored
- Delete individual or all cookies
- Block cookies from specific or all websites
- Set preferences for first-party vs third-party cookies
If you block or delete the strictly necessary cookies listed above, you will not be able to sign in to StableSync.
Signing out removes the offline copies. To remove everything StableSync keeps in your browser, clear the site data for stablesync.app in your browser settings; this also deletes any changes made offline that haven't been sent yet.
6. Do Not Track
We do not track you across websites. Since we do not use any analytics or advertising cookies, there is nothing for a Do Not Track signal to turn off.
7. Changes to this policy
If we add new cookies or change how we use existing ones, we will update this page and the “Last updated” date at the top. For significant changes, we will notify you through the platform.
8. Contact
If you have questions about our use of cookies, contact us at [email protected].
For details on how we handle personal data more broadly, see our Privacy Policy.