← Back to Dashboard

OpenBook legal

Cookie notice

How OpenBook uses cookies and similar browser storage.

Last updated 4 August 2026

OpenBook uses cookies and similar browser storage for sign-in, security, private customer sessions, and optional booking convenience. OpenBook does not set advertising or cross-site tracking cookies by default.

Cookies can behave differently on shared devices. Clear saved details before leaving a public, salon, school, or shared phone or computer.

Strictly necessary cookies

Owner and staff sign-in cookies keep dashboard sessions secure. They are HTTP-only where possible and are cleared on sign-out.

A private booking-link cookie can keep access to that one booking available while the customer uses the private-link flow.

If optional customer accounts are enabled, OpenBook uses short-lived HTTP-only cookies for the email-code linking intent or Facebook PKCE verifier and safe return path, followed by separate customer-only Supabase access, refresh, and selected-business cookies. These cookies do not sign the customer into an owner or staff dashboard.

If an owner connects a supported Meta business channel, OpenBook uses separate short-lived HTTP-only cookies to bind the permission response and asset-selection step to that owner and business. The temporary provider grant is encrypted, path-scoped, expires after about ten minutes, and is cleared when setup finishes or is cancelled.

Owner onboarding can save an unfinished setup draft in this browser, including business contact details and staff names. It is removed after setup or when read more than seven days after it was saved.

Security and rate-limit data helps prevent abuse and protect public booking writes.

The optional returning-client cookie is named ob_client. It can store the customer name, email address, and phone number entered on a booking form so a future booking page for the same business on the same device can pre-fill those fields.

It is scoped to that business under /book, uses SameSite=Lax, uses Secure on HTTPS, and lasts for 30 days unless cleared sooner. When a booking page next reads an older site-wide or shared /book version, OpenBook moves the saved details to that business path and removes the broader cookie.

The booking page needs to read this cookie to pre-fill the form, so it is set by browser JavaScript and cannot be HTTP-only.

The booking form asks before saving these details. Use Clear saved details on the booking page or clear browser cookies to remove it, especially on shared devices.

Provider and embedded contexts

Stripe, Meta or Facebook, Google, Microsoft, Supabase, Resend, or SendGrid may set their own cookies or use similar storage when their hosted pages, dashboards, or OAuth flows are opened.

Embedded booking widgets should not add advertising cookies. Website owners embedding OpenBook are responsible for their own site cookie banner and any analytics or marketing tags they add around the widget.