Cookie and Tracking Notice
Version 1.0 · Effective 24 July 2026
This notice explains what Brainstorme stores on your device when you use the Platform at https://portal-qa.brainstorme.com, why, and how to control it. It supplements our Privacy Notice.
"Cookies" here also covers equivalent technologies — localStorage,
sessionStorage and similar browser storage.
1. The short version
- Some storage is strictly necessary to sign you in and remember your privacy choice. It cannot be switched off, and it does not need your consent.
- Analytics and session recording are optional. They are linked to your account by default, so your usage is associated with your email address. Your IP address is discarded.
- You can unlink analytics from your account at any time, which keeps it running pseudonymously against a random identifier instead.
- You can turn analytics and session recording off at any time, which stops collection and clears the analytics identifier from your device.
- We use no advertising cookies, no ad networks, and no cross-site tracking. We do not sell or share data for advertising.
2. What we store
Strictly necessary
Always active. Without these the Platform cannot function.
| Name | Set by | Purpose | Type | Expiry |
|---|---|---|---|---|
sb-*-auth-token | Supabase (our authentication provider) | Keeps you signed in and maintains your session | First-party | Session / until sign-out or token expiry |
bs_consent | Brainstorme | Remembers your analytics choice so we do not ask again | First-party | 12 months |
| In-app notification state | Novu (our notification provider) | Tracks which in-app notifications you have seen | First-party | Session |
Analytics and session recording — optional
| Name | Set by | Purpose | Type | Expiry |
|---|---|---|---|---|
ph_*_posthog | PostHog (our analytics provider) | Stores your analytics identifier and session identifier, so that page views, feature usage and session recordings from the same browser can be grouped together rather than fragmented. By default this identifier is your account; if you unlink it, a random pseudonymous identifier is used instead | First-party | 12 months |
What session recording captures. We record a replay of your interactions with the Platform interface — the pages you view, where you click, and how you navigate — so we can diagnose faults and improve usability. Password fields and form inputs are masked by the recorder and are not captured.
Recordings are of the Platform interface, which in the course of your work may display study content such as study-assigned participant codes. Recordings are stored with our analytics provider in the United States, access is restricted to authorised Brainstorme staff, and they are deleted at the end of the retention period configured with that provider.
Why the identifier persists. Storing the identifier means a recording follows a continuous session instead of restarting at every page load. Whether it is your account or a random value, we treat it as personal data and describe it in our Privacy Notice accordingly.
What we do not send. Your IP address is discarded. Clinical trial participant identifiers and clinical values are never included in analytics events — they are stripped before anything is sent, because that data belongs to the study sponsor and our analytics provider is not a recipient of it.
3. Your choices
When you first visit, we show you a banner. Depending on where you are, it will either ask you to opt in before optional storage is used, or tell you what we do and let you opt out.
At any time afterwards, go to Your Data & Privacy on your profile page to:
- turn analytics and session recording off — we stop capturing and clear the analytics identifier from your device;
- turn them back on;
- unlink analytics from your account, so it continues pseudonymously against a random identifier rather than your email — or link it again later.
Withdrawing is as easy as giving consent. Withdrawal does not affect anything processed before you withdrew.
Browser controls. You can also block or delete cookies in your browser settings. Blocking strictly necessary storage will prevent you from signing in.
Do Not Track / Global Privacy Control. We honour the Global Privacy Control (GPC) signal where your browser sends one, treating it as an opt-out of optional analytics.
4. Changes
We will update this notice when the technologies we use change. The version and effective date at the top always reflect the current version.
5. Contact
Questions about this notice: ryan@brainstorme.com
Cookie and Tracking Notice · version 1.0 · effective 24 July 2026