Cookie Policy
Last updated: 8 August 2026
Poly sets very few cookies and no tracking cookies at all. This page lists every one, and the browser storage we use instead. It forms part of the Privacy Policy.
Why you have not seen a consent banner
Consent is required for cookies that are not strictly necessary to provide a service you asked for — analytics, advertising, cross-site tracking. We do not set any. There is no third-party analytics script, no advertising pixel, and no cross-site tracker anywhere in the product or on the marketing pages.
So there is nothing to ask you about. The absence of a banner is a consequence of that, not an oversight, and if that ever changes this page and a banner will appear together.
Cookies we set
| Name | Purpose | Lifetime |
|---|---|---|
poly_session | Keeps you signed in across Poly sites. HttpOnly, so no script — ours or anyone else's — can read it. SameSite=Lax. | 30 days |
poly_access | Carries your API credential. HttpOnly and SameSite=Strict — stricter than the session cookie, because this one is the credential itself. | 1 hour |
Both are set by our own servers on our own domain, are marked Secure in production, and exist only to keep you signed in. Neither is shared with anyone and neither follows you to another site.
Browser storage, which is the bigger part
Most of what Poly keeps in your browser is in localStorage, sessionStorage and IndexedDB rather than in cookies. Unlike a cookie, none of it is sent to a server automatically — it stays on your device until something in the page deliberately reads it.
| What | Why | Cleared when |
|---|---|---|
| Access and refresh tokens | Keeping you signed in within this browser | You sign out |
| Interface preferences | Theme, layout, sidebar state, open tabs, which section you were in | You clear site data |
| Drafts and local documents | So a half-written message, document or canvas survives a reload. Held in IndexedDB | You delete them, or clear site data |
| Incognito chat state | Held in sessionStorage deliberately, so it dies with the tab | You close the tab |
| Encrypted wallet vault | Your recovery phrase, encrypted under a passphrase we have never seen. This is the most sensitive thing in your browser and it is deliberately not on our servers in a usable form | You remove the wallet from the device |
⚠ Clearing site data can destroy your wallet. If you clear browser storage for Poly without having written down your recovery phrase, the vault goes with it and nobody — us included — can restore it. That is the price of us not holding your keys.
Controlling all of it
- Sign out to clear the session cookies and the tokens.
- Your browser settings can block or delete cookies and site data for poly.inc at any time. Blocking our session cookies means you cannot stay signed in; nothing else breaks.
- Do Not Track and Global Privacy Control signals have nothing to act on here, because there is no tracking to switch off.
Embedded third parties
Some features load content from other services — model providers, RPC endpoints for wallet and market data, media you paste in. Those requests reach the service concerned and are subject to its own practices. We do not embed advertising or social widgets.
Changes
If we ever add a cookie that is not strictly necessary, we will add it to the table above, ask for your consent first, and date the change here. privacy@poly.inc.