Kanbrio Cookie Policy
Version 1.0 · Effective 29 September 2026
Applies to: kanbrio.com, www.kanbrio.com, app.kanbrio.com, auth.kanbrio.com, api.kanbrio.com (including the MCP endpoint at api.kanbrio.com/mcp) and files.kanbrio.comPublished at: https://kanbrio.com/cookies
Summary in plain English
- We use cookies and browser storage only to make Kanbrio work: to sign you in, keep you signed in, protect the sign-in process, keep the service secure, and remember a few display choices you make.
- We use no analytics, advertising, tracking or social-media cookies. We do not use tracking pixels, session replay or browser fingerprinting, and we do not sell or share cookie data with anyone.
- Because everything we use is strictly necessary (or only remembers the app's display layout), we do not show a cookie consent banner. If we ever want to add something that is not strictly necessary, we will ask for your consent first and update this policy before it goes live.
- Our public website (kanbrio.com) sets no cookies of its own. Our security provider, Cloudflare, may set short-lived security cookies on any of our sites.
- Our API and MCP endpoint do not use cookies at all. People and AI agents authenticate there with tokens or API keys sent in request headers.
- When you pay, you are sent to PayPal's own website. PayPal's cookies there are covered by PayPal's policies, not this one.
- You can block or delete cookies in your browser. If you block the sign-in cookies, you will not be able to sign in to the Kanbrio app.
- Questions: [email protected].
1. Who we are
Kanbrio is operated by [to be confirmed] (ABN [to be confirmed]) of [to be confirmed], trading as Kanbrio ("Kanbrio", "we", "us", "our").
This Cookie Policy explains which cookies and similar technologies we use on our websites and in the Kanbrio app, why we use them, how long they last and how you can control them. It sits alongside our Privacy Policy (https://kanbrio.com/privacy), which explains how we handle personal information more generally. If the two ever conflict about cookies, this policy applies.
2. What cookies and similar technologies are
- A cookie is a small text file that a website asks your browser to store. Your browser sends it back to that website on later visits, so the website can recognise your browser, for example to keep you signed in.
- A first-party cookie is set by the site you are visiting. A third-party cookie is set by a different company's domain.
- A session cookie is deleted when you close your browser. A persistent cookie stays until it expires or you delete it.
- Local storage is a similar feature that lets a website keep small pieces of information in your browser. Unlike cookies, it is not sent to the website automatically with every request.
- Privacy laws, including the EU ePrivacy Directive and the UK Privacy and Electronic Communications Regulations, treat local storage and similar technologies in the same way as cookies. In this policy, "cookies" includes them unless we say otherwise.
3. Our approach
We have made a deliberate choice to keep Kanbrio free of tracking. In particular:
- Only strictly necessary cookies. Every cookie we set is needed to provide a service you have asked for: signing in, staying signed in, completing a secure sign-in, or protecting the service from attack and abuse.
- Display preferences. The Kanbrio app stores a small number of display settings in your browser's local storage, so the app keeps the layout you chose. These are described in section 6.
- No analytics or advertising. We do not use Google Analytics or any other analytics tool, advertising network, retargeting pixel, social-media plug-in, heat-mapping or session-recording tool.
- No third-party content that tracks you. Our fonts are bundled with our own website when we build it, so your browser does not contact Google or any other font provider. The app's security rules only let the browser load scripts from our own servers. They also block third-party frames, so no third party can embed tracking scripts in our pages.
- No selling or sharing. We do not sell cookie data. We do not share it for advertising, and we do not use it to build profiles of you.
Why there is no cookie banner. The law generally requires consent before a website stores or reads information on your device. There is an exception for storage that is strictly necessary to provide a service you explicitly asked for. Everything described in this policy falls within that exception, or only stores the display layout of the app you asked to use. For that reason we do not ask for consent, and we do not show a banner that would give you no real choice.
If this changes. We will not add analytics, advertising or any other non-essential cookies without first:
- updating this policy, and
- where the law requires it (for example for visitors in the European Economic Area or the United Kingdom), asking for your consent through a clear choice that is as easy to refuse as it is to accept.
4. Summary of what is set, by site
| Site | What it is | Cookies or storage |
|---|---|---|
| kanbrio.com and www.kanbrio.com | Our public website (www redirects to kanbrio.com) | None set by Kanbrio. Cloudflare may set security cookies (section 5.4) |
| app.kanbrio.com | The Kanbrio app | Sign-in cookies (section 5.1) and display preferences in local storage (section 6). Cloudflare security cookies (section 5.4), including the Cloudflare Access cookie while Access protects the app |
| auth.kanbrio.com | Our sign-in service (Keycloak, run by us on our own servers) | Sign-in session cookies (section 5.2) |
| api.kanbrio.com (including /mcp) | Our API and MCP endpoint for integrations and AI agents | No cookies. Requests are authenticated with a bearer token or API key sent in a request header |
| files.kanbrio.com | File attachments | No cookies. Downloads and uploads use short-lived signed links |
| paypal.com | PayPal's checkout | Set by PayPal on PayPal's own website (section 7) |
5. Cookies in detail
All cookies set by Kanbrio are first-party: they belong to the kanbrio.com site you are using and are never readable by any other company. Where a cookie is marked HttpOnly, scripts running in the page cannot read it, which protects it from being stolen through a malicious script. Where it is marked Secure, it is only ever sent over an encrypted (HTTPS) connection.
5.1 Sign-in cookies on app.kanbrio.com
The Kanbrio app uses Auth.js, an open-source sign-in library, to connect you to our sign-in service. It sets the following cookies. On our live site the names carry a __Secure- or __Host- prefix, which tells your browser to accept them only over HTTPS.
| Cookie name | Purpose | Duration | Category |
|---|---|---|---|
__Secure-authjs.session-token | Keeps you signed in. Holds your sign-in session in encrypted form. It contains the tokens our servers use to act on your behalf and basic profile details (your name and email address). Only our server can decrypt it. The tokens are never shown to scripts in your browser. If the session is too large for one cookie, it is split into numbered parts (.0, .1 and so on) | Up to 30 days from your last activity. Signing out deletes it. In practice your session also ends when your sign-in session at auth.kanbrio.com ends (section 5.2) | Strictly necessary. HttpOnly, Secure |
__Host-authjs.csrf-token | Protects sign-in and sign-out requests from cross-site request forgery, where another website tries to trigger an action in your account without your knowledge | Session (deleted when you close the browser) | Strictly necessary. HttpOnly, Secure |
__Secure-authjs.callback-url | Remembers which page to return you to after you sign in | Session | Strictly necessary. HttpOnly, Secure |
__Secure-authjs.pkce.code_verifier, and where used __Secure-authjs.state and __Secure-authjs.nonce | One-time security values that link the start and the end of a sign-in, so a sign-in cannot be intercepted or replayed. They are deleted once sign-in completes | About 15 minutes, or until sign-in completes | Strictly necessary. HttpOnly, Secure |
5.2 Sign-in cookies on auth.kanbrio.com
Our sign-in service is Keycloak, an open-source identity server that we run on our own servers in Australia. It is not a third-party service. It sets the following standard Keycloak cookies. Some have a companion cookie with the same name plus _LEGACY, which exists only so that older browsers behave correctly.
| Cookie name | Purpose | Duration | Category |
|---|---|---|---|
AUTH_SESSION_ID | Tracks a sign-in or registration while it is in progress, and routes it to the right server | Session | Strictly necessary |
KC_RESTART | Lets an interrupted sign-in be restarted safely. Holds encrypted sign-in-in-progress details | Session | Strictly necessary |
KEYCLOAK_IDENTITY | Proves you have already signed in, so you are not asked for your password again on every visit (single sign-on) | Until your sign-in session ends. Session cookie unless you tick "Remember me" | Strictly necessary. HttpOnly, Secure |
KEYCLOAK_SESSION | Identifies your sign-in session, so that signing out works everywhere you are signed in | Until your sign-in session ends. Session cookie unless you tick "Remember me" | Strictly necessary. Secure |
KEYCLOAK_REMEMBER_ME | Set only if you tick "Remember me" on the sign-in page. Remembers that choice and may pre-fill your username (your email address) next time | Up to 1 year, or until you sign out without "Remember me" | Set at your request. Secure |
How long a sign-in session lasts. A sign-in session at auth.kanbrio.com ends when you sign out, when it has been inactive for too long, or when it reaches its maximum length. We set these limits to balance security and convenience, and we may change them. When a session ends, the related cookies stop working and you will be asked to sign in again.
5.3 The API, MCP endpoint and AI agents
api.kanbrio.com, including the MCP endpoint at api.kanbrio.com/mcp and the realtime connection the app uses for live updates, does not set or read cookies. Every request, whether from the Kanbrio app, your own integration or an AI agent, carries its credential in a request header: a sign-in token or a Kanbrio-issued API key.
Agent API keys are secrets that you manage in your workspace settings. They are not cookies and are never stored in your browser by Kanbrio.
5.4 Cloudflare security cookies (all our sites)
Traffic to all our sites passes through Cloudflare, Inc., which protects the service against attacks, automated abuse and overload. Cloudflare acts as our service provider (a sub-processor, listed at https://kanbrio.com/subprocessors). Depending on the security features active at the time, Cloudflare may set the following cookies on our domains:
| Cookie name | Purpose | Duration | Category |
|---|---|---|---|
__cf_bm | Distinguishes people from automated bots, so bad traffic can be blocked without blocking you | 30 minutes | Strictly necessary (security) |
cf_clearance | Records that your browser passed a security check (a challenge), so you are not asked again straight away | Usually 30 minutes. It can be longer, up to 1 year, depending on the security setting | Strictly necessary (security) |
_cfuvid | Used by rate limiting to tell visitors apart when many share one network address | Session | Strictly necessary (security) |
CF_Authorization and related Cloudflare Access cookies | app.kanbrio.com only, while access is restricted. Cloudflare Access lets only approved people reach the app during our pre-launch period. This cookie proves you passed that check. We will remove Access, and with it this cookie, when the app opens to the public | For the Access session we set, typically up to 24 hours | Strictly necessary (security) |
These cookies do not identify you personally. Cloudflare uses them only to provide its security service to us. For more detail see Cloudflare's own documentation on the cookies it sets.
6. Local storage used by the Kanbrio app
The Kanbrio app (app.kanbrio.com) remembers a few display choices in your browser's local storage, so the app looks the way you left it next time. These values:
- are written when you open the app or a board (
kb_densityandkb_groupby, recording the current or default layout), or when you open or close a section of a card (kb_sec_keys); - stay on your device and are never sent to our servers or anyone else;
- contain no names, email addresses or content from your cards.
| Key | What it remembers | Duration |
|---|---|---|
kb_density | Whether the board shows cards in "comfortable" or "compact" layout | Until you clear your browser's site data |
kb_groupby | How the board groups cards into swimlanes (for example by assignee), including when you apply a saved view | Until you clear your browser's site data |
kb_sec_<card-id>_<section> | Whether a section of a card's detail panel (such as Labels or Time tracking) is open or collapsed. The key contains the card's internal ID, a random code that means nothing outside your workspace | Until you clear your browser's site data |
Shared or public computers. Signing out removes your sign-in cookies, but it does not clear these display preferences. They reveal nothing about the content of your work, but the kb_sec_ keys do show that someone using that browser opened particular cards in Kanbrio. On a shared computer, clear the site data for app.kanbrio.com, or use a private browsing window.
7. Third-party sites
- PayPal. When you buy or change a paid plan, you are redirected to PayPal's website to approve the payment. We do not embed PayPal's scripts or frames in our pages. Any cookies PayPal sets on paypal.com are PayPal's responsibility and are governed by PayPal's cookie and privacy statements. PayPal handles your payment as an independent controller, as explained in our Privacy Policy.
- Other payment options. If we add another way to pay, such as a cryptocurrency payment option, and it sends you to that provider's website, the same applies: that provider's own cookie policy covers its site. We will update this policy if any payment option places cookies on our own sites.
- Links. Our sites link to other websites, for example GitHub. Once you follow a link, the other site's cookie policy applies.
- Your own integrations. You can connect Kanbrio to outside services, such as webhooks, MCP servers or git hosting. Those connections run between our servers and the outside service; they do not place cookies in your browser. Anything you do on those services' own websites is covered by their policies.
8. Emails
The emails we send (such as invitations, notifications and digests) are sent through Twilio SendGrid. Our emails are not designed to track you. We do not use tracking pixels to detect when you open an email, and we do not rewrite links in our emails to record clicks. Links in our emails go directly to kanbrio.com addresses.
9. How to control cookies and local storage
Browser settings. Every major browser lets you see, block and delete cookies and site data, either for all sites or for individual sites such as kanbrio.com. Look for "cookies" or "site data" in your browser's privacy or security settings, or its help pages. You can also use a private or incognito window, which deletes cookies and local storage when you close it.
What happens if you block them.
- If you block cookies for app.kanbrio.com or auth.kanbrio.com, you will not be able to sign in to the Kanbrio app, because signing in depends on them.
- If you block Cloudflare's security cookies, you may be shown security checks more often, or some requests may be refused.
- If you clear local storage, the app simply returns to its default display settings.
- Our public website at kanbrio.com works normally with cookies blocked.
Signing out. Signing out of Kanbrio deletes the app's session cookie. It also ends your sign-in session at auth.kanbrio.com, so those cookies stop working.
Do Not Track and Global Privacy Control. We do not track you across websites, and we do not sell or share personal information for advertising. There is therefore nothing for these browser signals to switch off. We treat them as consistent with how we already operate.
10. Your rights
Some of the cookies above are linked to your account, so the information in them can be personal information. You have the rights described in our Privacy Policy, which may include rights to access, correct or delete your personal information, and to complain to a regulator. Depending on where you live, that regulator may be:
- the Office of the Australian Information Commissioner;
- a data protection supervisory authority in the European Union; or
- the UK Information Commissioner's Office.
We would appreciate the chance to resolve your concern first. Please contact [email protected].
11. Changes to this policy
We will update this policy whenever the cookies or similar technologies we use change. Each version shows its version number and effective date at the top, and the change log below records what changed.
We will not introduce non-essential cookies without updating this policy first and, where the law requires it, asking for your consent. If we make a material change that affects customers, we will also tell account owners by email or in the app before it takes effect.
12. Contact us
- Privacy and cookie questions: [email protected]
- Legal notices: [email protected]
- Post: [to be confirmed], [to be confirmed]
Change log
| Version | Effective date | Change |
|---|---|---|
| 1.0 | 29 September 2026 | First published version |