Cookie Policy
The short version: Cynaps sets the cookies needed to sign you in securely, plus local preferences like your theme. If you choose Accept all on the cookie banner, or switch on product analytics in Settings, we also set an analytics identifier for our product analytics (PostHog software we run on our own servers in India). It is off until you agree. We set no advertising, targeting or social-media cookies, and no tracking pixels. The Service works the same whichever option you choose. This policy is part of our Privacy Policy.
1. Cookies we set
| Cookie | Purpose | Lifetime | Type |
|---|---|---|---|
| cynaps_session | Keeps you signed in to the application (session token). | 30 minutes | Strictly necessary · httpOnly |
| cynaps_refresh | Renews your session so you are not signed out mid-consult. | 30 days | Strictly necessary · httpOnly |
| cynaps_csrf_token | Protects forms and API calls against cross-site request forgery. | 30 minutes | Strictly necessary |
| cynaps_internal_session / cynaps_employee_session | Sign-in for Cynaps internal staff portals only; never set for customers. | Up to 8 hours | Strictly necessary · httpOnly |
“httpOnly” cookies cannot be read by scripts in the page — they are sent only to our servers over encrypted connections.
2. Browser storage (localStorage)
Alongside cookies, we keep a small number of preference entries in your browser's local storage. These never leave your device:
- cynaps-theme / cynaps-theme-mode / cynaps-chat-font — Your display preferences (light/dark theme, font size).
- cynaps-cookie-consent — Records the choice you made on the cookie banner — necessary only, or analytics too — and when you made it.
- cynaps_device_trust — Marks a device you chose to trust so repeat sign-ins need fewer verification steps.
- Interface state (sidebar, dialogue mode, onboarding flags) — Remembers in-app UI choices between visits. Contains no patient data — a storage guard actively blocks identifiers from being persisted.
3. Analytics storage — only with your consent
| Name | Purpose | Lifetime | Type |
|---|---|---|---|
| ph_<project key>_posthog | A random identifier, linked to your account once you sign in, and your analytics setting, so your visits are counted as one person. | Up to 1 year | Analytics · optional · PostHog |
4. What we do not use
- No advertising, targeting, or social-media cookies.
- No tag managers, tracking pixels or web beacons, and no analytics other than PostHog — which runs only with your consent.
- No session recordings, heatmaps, or capture of what you type.
- No cross-site tracking or sale of data derived from cookies.
5. Managing cookies
You can delete or block cookies in your browser's privacy settings at any time. Because our sign-in cookies are strictly necessary, deleting them signs you out, and blocking them prevents sign-in. Preference entries can be cleared via your browser's “clear site data” control.
To change your analytics choice, use Settings → Privacy → Product analytics, or the Cookie settings button below. Switching it off stops analytics immediately and deletes the analytics identifier from your browser.
6. Contact
Questions about this policy: grievance@cynaps.co. This policy is issued by NBALL Technologies India Private Limited (CIN: U62099TS2025PTC196111).