Cookie Policy

Cookies are small text files stored by your browser. Similar technologies include browser local storage, session storage, pixels, tags, and SDKs. This policy explains which technologies Rect uses, why we use them, and how you can control optional categories.

Essential technologies are active because they are necessary to authenticate users, protect Rect, preserve requested settings, and provide features you explicitly use. Blocking them in your browser may prevent Rect from working.

• sb-<project-ref>-auth-token and related split cookies — Supabase authentication and session refresh; retained for the configured session lifetime.
• rect_cookie_preferences — stores your optional category choices and their version; up to one year.
• rect_anonymous_agent — pseudonymous continuity and abuse control for an anonymous hosted-Agent session; up to one year, and created only when that feature is used.
• theme and lang — appearance and language; theme lasts up to one year and language generally lasts until removed by the browser.
• sidebar_state — sidebar preference; up to seven days.
• last-viewed-workspace and last-selected-team — requested workspace navigation; up to 30 days.
• rects-layout — grid or list preference; up to one year.

Rect also uses local or session storage for short-lived UI state, upload or Agent handoffs, permission notices, and the last sign-in method hint. These values are not used for advertising. Sandboxed Rect views cannot read the host application's authentication cookies or browser storage.

If you enable Optional functionality, Rect may load Google One Tap so Google can automatically offer a signed-in Google account. Loading One Tap can disclose your IP address, browser information, and current Google session to Google and may allow Google to use its own technologies. You can still select the ordinary Google OAuth button without enabling automatic One Tap; that user-initiated flow is essential to the sign-in method you choose.

If you enable Analytics, Rect loads Vercel Web Analytics to measure visits and product usage. The integration is cookieless, but it sends limited request and device information to Vercel. Before sending a page URL, Rect removes query strings, fragments, account slugs, and Rect or App capability identifiers. We use this information in aggregate to understand and improve Rect, not for behavioral advertising.

If you enable Browser diagnostics and Sentry is configured, Rect may send browser errors, performance traces, and sampled session replays to Sentry. Replays can capture interactions and page context, subject to Sentry masking and filtering configuration. Server-side security and reliability logging may continue without this optional setting because it is necessary to operate and protect the service.

When you choose a third-party sign-in button, open Stripe checkout or the billing portal, follow an external link, or ask the Agent to use a connected tool, the selected provider may set or read its own cookies under its privacy notice. These technologies are triggered by the service you requested rather than by Rect's optional analytics setting.

You can accept all optional categories, reject all optional categories, or choose them separately. Rejecting optional categories does not prevent you from signing in or using Rect's core features. Your new choice takes effect after the page reloads.

Cookie settings

You can also delete or block cookies using browser controls. If you clear the preference cookie, Rect will ask you to choose again. Some browsers provide global privacy signals; because Rect does not sell or share personal information for behavioral advertising, there is no sale or advertising share to opt out of.

We may update this policy when our technologies or legal obligations change. Contact Suri, Inc. at support@suri.team or by mail at 1111b South Governors Av #88996, Dover, DE 19904, US.