Cookie Policy
Last updated September 25, 2026
This policy explains what Blue Whale Software, LLC stores in your browser when you visit our websites or use Elmo Cloud, and what control you have over it. It supplements our Privacy Policy.
"Cookies" here is shorthand. It covers cookies, localStorage, and any other technology that stores or reads something on your device.
The short version
- We use more than one analytics tool. Some, like Plausible, set no cookies; others set cookies or store an identifier in your browser, and those follow your choices below.
- Where consent is required — currently the EEA, the UK, and Switzerland — we set no analytics or advertising cookie until you accept one. A banner asks on your first visit; no analytics or advertising storage is written before you answer.
- Everywhere else, analytics and advertising cookies are on by default, and you can turn them off from the Cookie preferences control on our site.
- Where we run session replay, it sits in the analytics category and follows your analytics choice — so in a consent region nothing is recorded until you accept.
Categories
The tables below describe what we set at the time of writing. The categories are the part that matters — what lands in each one changes as the tools we use change, and your choices apply to the category, not to a particular cookie.
Strictly necessary
These are always set. The site cannot work without them, and consent is not required for them under the ePrivacy Directive.
| What | Where | Purpose | Lifetime |
|---|---|---|---|
better-auth.session_token and related session cookies | app.elmohq.com | Keeps you signed in | For as long as you stay signed in |
| CSRF and callback state | app.elmohq.com | Protects sign-in and form submissions from cross-site request forgery | Minutes |
elmo.cookie-consent (localStorage) | elmohq.com, app.elmohq.com | Remembers your answer to the cookie banner so we don't ask again | Until you clear it |
| Load-balancing and security cookies | all | Set by our hosting providers to route requests and mitigate abuse | Session |
| Sentry session identifier (sessionStorage) | app.elmohq.com | Correlates errors from the same visit so a crash report is intelligible. No cookie. | Until the tab closes |
Analytics
Helps us understand what people do with Elmo so we know what to build and fix.
| What | Provider | Purpose | Lifetime |
|---|---|---|---|
| (no cookie) | Plausible | Aggregate page views and referrers. Cookieless — nothing is stored on your device and no cross-site identifier is created. | n/a |
ph_*_posthog and related localStorage entries | PostHog | Distinguishes one browser from another so we can count unique visitors and follow a flow through the product | Up to 1 year |
_ga, _ga_* | Google Analytics | Distinguishes visitors and sessions for traffic reporting | Up to 2 years |
_clck, _clsk | Microsoft Clarity | Ties a session replay and its interaction data to one visitor | Up to 1 year |
Advertising
Measures whether our advertising works. We don't sell personal information to these platforms.
| Provider | Purpose |
|---|---|
| Google Ads | Conversion measurement and remarketing |
| Meta | Conversion measurement and remarketing on Facebook and Instagram |
| Conversion measurement and remarketing | |
| X | Conversion measurement |
| Conversion measurement |
Where we run these tags, they load on our marketing site rather than inside the product, and only where advertising consent applies. Each platform sets its own cookies under its own domain; the links above go to each one's current cookie disclosure.
Third-party embeds
Some pages embed content from other services, which may set their own storage:
- YouTube — today we embed through
youtube-nocookie.com, which does not set tracking cookies unless you press play. - Mux — video playback on our website.
- Live chat — our support chat widget loads with the page and stores a session identifier, so a conversation survives a page reload.
Changing your mind
Look for Cookie preferences — it's in the footer of our website, and in the legal menu in Elmo Cloud. Your choice takes effect immediately: turning analytics off stops further collection and clears the identifier.
You can also block or delete cookies in your browser settings, or turn on Global Privacy Control, which we honor as an opt-out of advertising cookies. We don't respond to Do Not Track signals. Note that blocking strictly necessary cookies will stop you from being able to sign in.
Questions
Email privacy@elmohq.com.