Last updated: 18 September 2026
1. Who we are and what this policy covers
1.1 This policy covers cookies and similar technologies on the marketing site at daybeat.io and the app at my.daybeat.io, operated by Function 365 Limited, trading as Daybeat, company number 10069330, registered office Third Floor, 95 The Promenade, Cheltenham, Gloucestershire, United Kingdom, GL50 1HH.
1.2 Our Privacy Notice at /privacy explains how we handle personal data more generally. Contact us at info@function365.co.uk about this policy.
2. Definitions
2.1 Daybeat means our service, including the marketing site and app described in clause 1.1.
2.2 Privacy Notice means our notice about handling personal data, linked in clause 1.2.
3. What cookies and similar technologies are
3.1 A cookie is a small text file stored by your browser and sent back to the relevant website on later requests.
3.2 First-party cookies come from the site you visit, third-party cookies come from another organisation through that site, and persistent cookies remain until they expire or you delete them.
3.3 Similar technologies, including local storage, keep information in your browser for the website to use and are also covered by this policy.
4. The marketing site
4.1 Strictly necessary cookies are set without consent. Where used on the marketing site at daybeat.io, analytics and advertising cookies, including technologies managed through Google Tag Manager and Meta pixel for conversion measurement, are set only with your consent through the site's cookie controls. Optional technologies remain inactive unless you consent.
4.2 The marketing site loads Google Fonts from fonts.googleapis.com and fonts.gstatic.com. Your IP address and browser user agent reach Google when the fonts are requested; this does not set a cookie.
4.3 Analytics and advertising technologies described in clause 4.1 are confined to the marketing site and are not used in the signed-in portal. They do not send Workspace Customer Data to advertising platforms. The app's authentication and referral functions are described separately below.
5. Cookies in the app
5.1 The table describes authentication cookies used during sign-in and app use, a staff-only support cookie, and the referral cookie set when you arrive through a referral link, which can happen before sign-in. Authentication cookie names below are the production names, including the __Secure- prefix. Trusted-device cookies have a 30-day Max-Age; a seven-day server-side trust record limits staff trust, so the effective staff window is seven days.
| Name | Set by | Purpose | Lifetime | Type |
|---|---|---|---|---|
__Secure-daybeat.session_token | Daybeat through its self-hosted Better Auth library | Maintain your signed-in session and identify your account | 30-day session, refreshed at most every 24 hours | First-party; persistent; strictly necessary; HttpOnly, SameSite=Lax, Secure; Path=/; Domain: host-only |
__Secure-daybeat.dont_remember | Daybeat through Better Auth | Record that you did not ask to be remembered, so the session is not extended | Session cookie, with no Max-Age | First-party; strictly necessary; HttpOnly, SameSite=Lax, Secure; Path=/; Domain: host-only |
__Secure-daybeat.trust_device | Daybeat through its authentication library's two-factor function | Remember a device you choose to trust, so the two-factor challenge can be skipped on that device | 30 days. For Daybeat staff the trust is re-challenged after 7 days by a server-side record, even though the cookie itself carries the longer expiry | First-party; persistent; strictly necessary for the security function you choose; HttpOnly, SameSite=Lax, Secure; Path=/; Domain: host-only |
__Secure-daybeat.two_factor | Daybeat through its authentication library | Carry the half-completed sign-in while you enter your two-factor code | 10 minutes | First-party; persistent; strictly necessary; HttpOnly, SameSite=Lax, Secure; Path=/; Domain: host-only |
__Secure-daybeat.admin_session | Daybeat through its authentication library's staff support function | Support a read-only session in a customer's workspace; set only on a Daybeat staff device, never on a customer device | 30-day cookie Max-Age; the read-only support session itself is capped at 1 hour | First-party; strictly necessary for staff support access; HttpOnly, SameSite=Lax, Secure; Path=/; Domain: host-only |
daybeat_ref | Daybeat's referral landing route | Carry a referral token to checkout so a referral can be credited | 30 days, or until checkout resolves it if sooner | First-party; persistent; referral attribution, not strictly necessary; HttpOnly, SameSite=Lax, Secure on HTTPS; Path=/; Domain: host-only |
5.3 The 30-day session lifetime in the table is the customer session lifetime when remembered. Daybeat staff sessions are capped at 12 hours. Signing out ends your session. Cookie and session expiry do not mean that server records are deleted.
5.4 HttpOnly prevents browser scripts from reading a cookie; Secure restricts its transmission to HTTPS; SameSite=Lax limits when it is sent with requests from another site. Path=/ makes the cookie available across paths on its host. Cookies are host-only: no cross-subdomain cookie is configured.
5.5 The referral cookie contains a referral token and is set only when you arrive through a referral link. It is not needed to stay signed in. It is deleted as soon as checkout resolves it, whether or not the referral is credited.
5.6 We do not set a CSRF cookie: we use Origin header checks to help protect browser requests against cross-site request forgery. We do not set a theme or preference cookie.
5.7 We do not set Stripe cookies on our domain. Checkout takes place on Stripe's own domain, under Stripe's cookie notice, as described in section 7.
5.8 On a non-HTTPS development origin, the session cookie is named daybeat.session_token; production authentication cookies carry the __Secure- prefix shown above. The referral cookie is set separately and retains the bare name daybeat_ref. The authentication cookies session_data and account_data are not in use because the session cookie cache is off.
6. Local storage
6.1 The app uses two first-party local storage key patterns for interface state. Neither holds credentials or session data, and neither is used for tracking.
6.2 daybeat-piece-draft:${actorUserId}:${pieceId}:${currentVersionId} saves an in-progress draft of a piece you are editing so a refresh does not lose your edits. The key includes your user id, the piece id and its version id; the stored value is your draft content. It is cleared on cancel, discard and version change.
6.3 daybeat.billing-banner.dismissed.${tenantId}.${kind} records that you dismissed a billing banner in your workspace.
6.4 The local storage entries have no fixed time expiry. The draft entry is cleared on cancel, discard or version change. The billing-banner entry records the value “1” and remains until the app resets the relevant dismissal or you clear it through your browser's site-data controls.
6.5 We do not use session storage.
7. Third-party cookies and services
7.1 With your consent through the site's cookie controls, the marketing site may use analytics and advertising technologies, including Google Tag Manager and Meta pixel, for conversion measurement. These optional technologies are not used in the signed-in portal.
7.2 When you use Stripe Checkout or Stripe's billing portal, Stripe's own cookie notice applies to its services and any cookies it sets on its own domain.
7.3 Platforms you authorise through a connection have their own privacy and cookie notices, which govern your use of their services.
7.4 We do not sell information collected through cookies or provide Workspace Customer Data to advertisers or data aggregators. With your consent, marketing-site conversion measurement is shared with advertising platforms. We may make aggregated conversion-measurement reports available to business customers; these reports do not identify individual visitors.
8. How to control cookies and local storage
8.1 Most browsers allow you to inspect, block or delete cookies using browser settings, including settings for individual sites. Where optional analytics and advertising technologies are offered, use the marketing site's cookie controls to choose or withdraw consent. Withdrawing consent stops their future use and does not affect the lawfulness of earlier processing.
8.2 If you block authentication cookies from my.daybeat.io, you cannot stay signed in to the app. Blocking cookies only from the marketing host daybeat.io does not by itself block the app's sign-in cookies.
8.3 Deleting the referral cookie does not affect your account or use of the service, but may prevent the referral from being credited.
8.4 Use your browser's settings for site data or storage to remove local storage for my.daybeat.io. Clearing a saved draft removes the locally saved in-progress edits; clearing a billing-banner dismissal allows the banner to appear again if its display conditions still apply. Clearing all site data can also remove sign-in cookies and sign you out.
9. Changes and contact
9.1 We may update this policy. The last-updated date at the top identifies the current policy. We will provide required cookie information and obtain any required consent before using optional technologies.
9.2 Contact info@function365.co.uk, or write to Function 365 Limited at Third Floor, 95 The Promenade, Cheltenham, Gloucestershire, United Kingdom, GL50 1HH.
9.3 Our terms at /terms set out the law of England and Wales and the exclusive jurisdiction of the courts of England and Wales for the service.