Cookie Policy
Last updated October 7, 2026
This policy explains what Blue Whale Software, LLC stores in your browser when you visit our websites or use Elmo Cloud, and what control you have over it. It supplements our Privacy Policy.
"Cookies" here is shorthand. It covers cookies, localStorage, and any other technology that stores or reads something on your device.
The tables below describe what we set at the time of writing. The categories are the part that matters — what lands in each one changes as the tools we use change, and your choices apply to the category, not to a particular cookie.
These are always set. The site cannot work without them, and consent is not required for them under the ePrivacy Directive.
| What | Where | Purpose | Lifetime |
|---|---|---|---|
better-auth.session_token and related session cookies | app.elmohq.com | Keeps you signed in | For as long as you stay signed in |
| CSRF and callback state | app.elmohq.com | Protects sign-in and form submissions from cross-site request forgery | Minutes |
elmo.cookie-consent (localStorage) | elmohq.com, app.elmohq.com, demo.elmohq.com | Remembers your answer to the cookie banner so we don't ask again | Until you clear it |
| Load-balancing and security cookies | all | Set by our hosting providers to route requests and mitigate abuse | Session |
| Sentry session identifier (sessionStorage) | app.elmohq.com | Correlates errors from the same visit so a crash report is intelligible. No cookie. | Until the tab closes |
Helps us understand what people do with Elmo so we know what to build and fix.
| What | Provider | Purpose | Lifetime |
|---|---|---|---|
| (no cookie) | Plausible | Aggregate page views and referrers. Cookieless — nothing is stored on your device and no cross-site identifier is created. | n/a |
ph_*_posthog and related localStorage entries | PostHog | Distinguishes one browser from another so we can count unique visitors and follow a flow through the product | Up to 1 year |
_ga, _ga_* | Google Analytics | Distinguishes visitors and sessions for traffic reporting | Up to 2 years |
_clck, _clsk | Microsoft Clarity | Ties a session replay and its interaction data to one visitor | Up to 1 year |
Measures whether our advertising works. We don't sell personal information to these platforms.
| Provider | Purpose |
|---|---|
| Google Ads | Conversion measurement and remarketing |
| Meta | Conversion measurement and remarketing on Facebook and Instagram |
| Conversion measurement and remarketing | |
| X | Conversion measurement |
| Conversion measurement |
Where we run these tags, they load on our marketing site and our public demo, and inside Elmo Cloud only on the signup and plan-selection pages. In Elmo Cloud they report that a signup or subscription happened, with a hashed copy of your email address so the platform can match it to an ad, never what's in your account. They load only where advertising consent applies.
Google Ads sets _gcl_au and _gcl_aw, and Meta sets _fbp and _fbc, under our own domain for up to 90 days to connect an ad click with what happened afterwards. Each platform also sets cookies under its own domain; the links above go to each one's current cookie disclosure.
Some pages embed content from other services, which may set their own storage:
youtube-nocookie.com, which does not set tracking cookies unless you press play.Look for Cookie preferences — it's in the footer of our website, and in the legal menu in Elmo Cloud and the demo. Your choice takes effect immediately: turning analytics or advertising off stops further collection and clears the identifiers we set.
You can also block or delete cookies in your browser settings, or turn on Global Privacy Control, which we honor as an opt-out of advertising cookies. We don't respond to Do Not Track signals. Note that blocking strictly necessary cookies will stop you from being able to sign in.
Email privacy@elmohq.com.