Cookie Policy
Last Updated: August 27, 2026
This Cookie Policy explains how Know Reply Inc. (“Know Reply”, “we”, “us”) uses cookies and similar technologies on the Earnesty websites — our marketing site at https://earnesty.app and our application at https://go.earnesty.app — and how the USER status pages at *.earnesty.page differ. It sits alongside our Privacy Policy, which explains what we do with personal data generally, and the USER Privacy Notice, which explains what USERs specifically should know.
We keep this short on purpose. Earnesty sets very few cookies, and we would rather list the ones we actually set than pad this page with categories we do not use.
1. What Cookies Are
Cookies are small text files stored on your device when you visit a website. They are widely used to make sites work — remembering that you are logged in, for instance — and to understand how a site is used. A cookie set by the site you are visiting is a first-party cookie; one set by another service running on that site is a third-party cookie. This policy also covers similar technologies such as localStorage and session storage, which do the same job by a different mechanism.
2. Strictly Necessary Cookies
These are the cookies Earnesty cannot work without. They carry no advertising purpose and are not used to build a profile of you. Under the ePrivacy Directive, UK PECR, and equivalent laws they do not require consent — but we still list them, because you are entitled to know what is on your device.
All of them are set by our authentication layer (better-auth), are HttpOnly, Secure,
and SameSite=Lax, and are first-party to our API host. In production their names carry the
__Secure- prefix; in local development they do not.
| Cookie | Purpose | Lifetime |
|---|---|---|
__Secure-better-auth.session_token | A signed, opaque session token. It maps to a session record on our side; the token itself carries no personal data. | 7 days by default. If you sign in without “remember me”, it becomes a browser-session cookie that disappears when you close the browser. |
__Secure-better-auth.dont_remember | Records that this session must not persist. Only set when you sign in without “remember me”. | Browser session |
__Secure-better-auth.state | Binds a social or single-sign-on round trip to your browser, so the sign-in cannot be forged. Only set while such a sign-in is in progress. | 5 minutes |
We do not set a separate CSRF cookie. Requests that change something are protected by
origin checking against an allow-list, by the browser’s own Sec-Fetch-* headers, and by
SameSite=Lax — not by a token in a cookie.
We record an IP address and user-agent string against a session for security and abuse detection. That is described in the Privacy Policy, not here, because it is stored on our side rather than on your device.
3. Analytics
We want to know how many people visit and which pages they read. We do not want to know who they are, and we have chosen tooling that makes that difference real rather than promised.
We use Umami, and we run it ourselves. It is open-source analytics that works without cookies: it writes no identifier to your device, stores no persistent identifier at all, and hashes IP addresses rather than keeping them. Because nothing is stored on or read from your device, the rules that would otherwise require a consent banner do not apply — so there is no banner to click, and nothing to opt out of, because there is nothing on your device to object to.
It runs on our own infrastructure. Your visit is not shared with an analytics company, because there is no analytics company involved. This is also why our sub-processor list does not grow when we measure traffic — see the Data Processing Addendum.
What we get is aggregate: page views, which pages, roughly where in the world, what referred someone. Not a profile, not a journey stitched across sites, and nothing that follows you after you leave.
One honest note on the law. Most European regulators — France’s CNIL and the UK’s ICO among them — do not require consent for analytics that store nothing on a device. Germany and Italy read the rules more strictly and prefer clear disclosure even in that case. This section is that disclosure.
Checked, not assumed. Before writing any of this in the present tense, we loaded these pages in a clean browser profile and confirmed that nothing was written: no cookie, no local storage, no session storage. The claim that we store nothing on your device is the entire basis for there being no banner on this site, so it is verified in what we actually deploy rather than taken from our tooling’s documentation. We will check it again whenever we change how these pages are built.
4. Third-Party Cookies
Stripe. Payments and subscriptions for APPs are handled by Stripe, Inc. On pages that
load Stripe’s payment components, Stripe sets __stripe_mid (about a year) and
__stripe_sid (about 30 minutes) to detect and prevent fraud. Stripe describes these as
essential to that purpose.
Our static hosting and API platform set no cookies of their own.
5. USER Status Pages Are a Separate Surface
USER status pages live at *.earnesty.page — one subdomain per APP, for example https://acme.earnesty.page. They are a deliberately different kind of page and they are treated differently here.
- A status page does not require an Earnesty account, and it sets no Earnesty login cookie. A USER of an APP is not our customer and does not sign in to Earnesty.
- It is served from its own domain. Cookies set on
earnesty.appandgo.earnesty.appare not readable fromearnesty.page, and the reverse is also true. That separation is intentional: an APP’s USERs and an APP’s staff are different populations and their sessions do not mingle. - What a status page sets is limited to what is strictly necessary to show that USER their own Claim, their post history, and when a reply bonus settles, and to keep the “check now” button honest against abuse. It carries no analytics or advertising cookies. No cookie is used to hold a USER’s status-page view open. Verified against
apps/api/src/services/status-token.tson 2026-08-27: access is carried by a signed, expiring token in the URL, minted server-side by the APP each time it renders the page, with a 24-hour default lifetime. It carries Earnesty’s own internal identifier rather than the APP’s identifier for the person, and it sets nothing in the browser — no cookie, no local storage, no session storage.
This is deliberate. A USER has no Earnesty account and should never need one to see their own Claim, so we neither authenticate them nor store anything on their device.
- When a status page is embedded inside an APP’s own product, the surrounding page is the APP’s, and any cookies that page sets are the APP’s responsibility under the APP’s own privacy policy, not ours.
What we hold about a USER, and for how long, is set out in the USER Privacy Notice. Some of it is governed by a platform’s rules rather than by ours — see Supported Platforms.
6. How to Control Cookies
- Browser settings. Every major browser lets you view, block, and delete cookies, per site or in bulk. Your browser’s help pages have the instructions. Blocking cookies on
go.earnesty.appwill prevent you signing in. - Sign out. Signing out ends the session on our side and clears the session cookie. Doing this on a shared or public computer is worth the two seconds.
- Clearing site data. Clearing cookies and site data for our domains removes everything described in this policy from your device. Nothing you lose by doing so is unrecoverable — you will simply sign in again.
- Do Not Track and Global Privacy Control. We do not run cross-site tracking or targeted advertising. We will honor Global Privacy Control as an opt-out signal for any non-essential cookie we set.
7. Consent
Strictly necessary cookies do not require consent under the GDPR, the UK GDPR, or the ePrivacy Directive — and they are the only cookies we set.
There is no consent banner on this site, because there is nothing to consent to. Our analytics store nothing on your device (Section 3), so the rule that would trigger a banner is not engaged. We would rather run tooling that makes the banner unnecessary than run tooling that makes it mandatory and then ask you to dismiss it.
If we ever introduce something that does store or read data on your device for a non-essential purpose, we will ask first, the thing will stay off until you say yes, refusing will be exactly as easy as accepting, and you will be able to change your mind from the same place you decided.
8. Changes to This Policy
We will update this page when our use of cookies changes, and we will change the Last Updated date when we do. A material change — in practice, adding any cookie that is not strictly necessary — will be announced to account holders rather than left to be discovered here.
Contact Us
Questions about this Cookie Policy, or about anything else we do with your data, go to privacy@earnesty.app. General questions go to hello@earnesty.app.
Know Reply Inc., a Delaware corporation.