Informational document · 26 October 2026
Cookie policy.
How Workbloom uses cookies and browser storage to provide the service and remember your choices.
Workbloom cookies and storage
Cookies are small pieces of data sent to your browser; sessionStorage holds data for an individual tab session. All items below are first-party on the Workbloom domain. Supabase names depend on the project reference. We do not use localStorage, IndexedDB or tracking widgets. Fonts are local; blog images may come from Supabase Storage.
| Name | Purpose and type | Category | Duration | First party |
|---|---|---|---|---|
| workbloom-language | Cookie: remembers your chosen language (IT/EN). | Requested preference | 365 days from selection | Yes — Workbloom |
| workbloom-theme | Cookie: remembers your chosen light/dark theme. | Requested preference | 365 days from selection | Yes — Workbloom |
| bloomia_guest_secret | HttpOnly cookie: protects ownership of guest chats. | Strictly necessary | 24 hours; renewed during use | Yes — Workbloom |
| bloomia_guest_active | HttpOnly cookie: identifies the selected guest conversation to resume. | Strictly necessary | 24 hours | Yes — Workbloom |
| workbloom-auth-journey | HttpOnly cookie, /auth path: routes company or Bloomer password setup. | Strictly necessary | 1 hour; removed after password setup | Yes — Workbloom |
| sb-<project-ref>-auth-token (sb-iefmcathlidypcyoeiyw-auth-token) | Supabase cookie: authentication and session refresh; may be split into .0, .1, etc. | Strictly necessary | Configured maximum: 400 days; removed on sign-out | Yes — Workbloom |
| sb-<project-ref>-auth-token-code-verifier | Supabase cookie: temporary PKCE authentication verification, when used; may be chunked. | Strictly necessary | Configured maximum: 400 days; removed during authentication exchange/cleanup | Yes — Workbloom |
| sb-<project-ref>-auth-token-flow-<flowId>-code-verifier | Supabase cookie: verification of a particular authentication flow, when used; may be chunked. | Strictly necessary | Configured maximum: 400 days; removed during authentication exchange/cleanup | Yes — Workbloom |
| sb-<project-ref>-auth-token-flows-code-verifier | Supabase cookie: authentication-flow coordination, when used; may be chunked. | Strictly necessary | Configured maximum: 400 days; removed during authentication exchange/cleanup | Yes — Workbloom |
| workbloom.bloomia-entry.v1 | sessionStorage: transfers the initial message from the homepage to chat. | Strictly necessary | Tab session; no additional expiry | Yes — Workbloom |
| workbloom.bloomia-draft.v1:guest / workbloom.bloomia-draft.v1:<userId> | sessionStorage: keeps unsent text and identifiers needed to resume a draft or retry sending. | Strictly necessary | Tab session; no additional expiry | Yes — Workbloom |
| workbloom.bloomia-draft.v1:guest:legacy-transfer / workbloom.bloomia-draft.v1:<userId>:legacy-transfer | sessionStorage: backup while transferring a legacy draft. | Strictly necessary | Tab session; no additional expiry | Yes — Workbloom |
| workbloom.need-draft.v1 | Legacy sessionStorage: read, migrated and removed; no longer created. | Strictly necessary | Tab session; no additional expiry | Yes — Workbloom |
The authentication cookie lifetime is not the server-side authorization lifetime. Supabase cookies are readable by its browser SDK: not all cookies are HttpOnly. Tab-session lifetime may depend on browser session-restoration features. Clearing local data does not erase messages already sent and stored on the server.
External Stripe checkout
Payment opens a Stripe-hosted page on a separate domain: we do not load Stripe.js on Workbloom pages. The following table describes tools Stripe documents as potentially used after navigation, not cookies observed or set by Workbloom. Checkout and optional Link services may use other tools depending on your choices: consult Stripe’s notice and controls.
| Name | Purpose / category | Documented duration | Workbloom first party |
|---|---|---|---|
| __stripe_mid | Cookie: fraud prevention | 1 year | No — Stripe |
| __stripe_sid | Cookie: fraud prevention | 30 minutes | No — Stripe |
| m | Cookie: fraud prevention | 2 years | No — Stripe |
| 1, _ab, _mf, id (m.stripe.network) | sessionStorage: fraud prevention | Session | No — Stripe |
| eid | Cookie: checkout experiments; not automatically classified as necessary | 2 months | No — Stripe |
Managing and deleting stored data
You can change language and theme using the site controls. To delete cookies and storage, open your browser settings, find Privacy / Cookies and site data, select the Workbloom domain and clear its data; select Stripe domains separately for checkout. You can also block cookies in browser settings. To clear sessionStorage drafts, close the tab and, if your browser restores sessions, also clear site data.
Clearing data can sign you out, remove unsent drafts, reset preferences and prevent that browser from recovering guest chats. Blocking necessary cookies may prevent sign-in and chat. To erase server-held data or exercise your rights, contact the controller: clearing cookies is not an account-erasure request.
Controller and contact
Workbloom S.r.l. · Via Sardegna 32, 20146 Milan, Italy · VAT and tax code 13981770962
privacy@workbloom.io