Effective date: August 26, 2026
EverPacket is local-first. Browser storage is not used only for tracking: it is where the editable packet itself lives. Clearing site data can permanently delete the only local working copy. Export a current .EverPacket project file before clearing browser data.
1. Scope
This Notice explains EverPacket's use of cookies, IndexedDB, local storage, session storage, service-worker Cache Storage, browser privacy signals, and related device technologies.
It applies to EverPacket-controlled pages. The Payment Merchant, identity providers, browser vendor, operating system, cloud drive, and other third parties use their own technologies under their own notices.
2. Categories
EverPacket uses the following categories:
-
Strictly necessary: required to provide local packet storage, authentication, checkout setup, entitlement, security, consent records, multi-tab safety, legal acceptance, and offline application functions.
-
Preferences: remember theme or whether authentication cookies should persist beyond the browser session.
-
Optional product and marketing analytics: content-blind product events, first-party campaign attribution, and signed text-slot experiment assignments used only after the applicable permission and privacy-signal checks.
EverPacket does not currently use advertising cookies, cross-site behavioral advertising pixels, session replay, keystroke capture, clipboard capture, or packet-content analytics.
3. IndexedDB - where packet contents live
The current application uses an IndexedDB database named `everpacket`. It may contain:
-
editable packet records and household information you enter;
-
project identifiers, titles, revisions, lineage, and timestamps;
-
checklist, review, gap, freshness, and portable state;
-
local output history and local backup history; and
-
import, migration, and repository metadata.
This is first-party device storage in the browser profile. It ordinarily persists until you delete the packet or site data, the browser profile is removed, the browser or operating system evicts it, or the device is lost or reset.
IndexedDB packet contents are not currently encrypted by EverPacket. A person with access to the device account, browser profile, developer tools, device backup, or storage may be able to read them.
IndexedDB is strictly necessary for the local-first product. Disabling it prevents normal packet editing and storage.
4. Local storage
The current code uses local storage for the following items. Durations are functional expectations, not a guarantee that a browser will retain data for that long.
| Key or key family | Category | Purpose | Typical duration and effect of removal |
|---|---|---|---|
| everpacket.analytics-consent.v1 | Optional analytics preference | Stores allowed or denied with analytics consent scope version | Until deleted or analytics consent scope version changes; removal prompts for a new choice where required |
| everpacket.anonymous-installation.v1 | Analytics consent and event integrity | Random browser installation UUID sent only with consent/signal records and permitted product events | Until site data is cleared or retention controls remove server-side records |
| everpacket.analytics-signal-recorded.v1 | Privacy signal | Prevents repeated server recording of the same GPC or DNT signal | Until deleted or signal/analytics consent scope version changes |
| everpacket.theme.v1 | Preference | Stores light or dark theme | Until deleted |
| everpacket.entitlement.account-receipt.v3 | Strictly necessary paid access | Stores a signed, browser-verifiable offline entitlement receipt and limited purchase-policy dates | Until replaced, removed after refund/dispute/no entitlement, expired, or site data is cleared |
| everpacket.entitlement.account-receipt.v2 | Legacy migration | Older entitlement key removed during migration | Transitional only |
| everpacket.free-use-terms.v1 | Strictly necessary legal acceptance | Stores free-use document version, integrity hash, and acceptance time | Until the version changes or site data is cleared |
| everpacket.writer-lease.<packetId> | Strictly necessary data integrity | Coordinates the active writer for a packet across tabs; includes packet ID, random tab owner ID, revision, and heartbeat timestamps | Normally removed on release; active lease expires about 15 seconds after the last heartbeat |
| lswt-<random probe> | Strictly necessary compatibility check | Transient Supabase Auth probe used to confirm that local storage is available; written and immediately removed | Milliseconds; no durable value remains. Removal has no practical effect because the probe is already deleted |
| everpacket.marketing-visitor.v1 | Optional marketing analytics | Stores a random visitor UUID used for first-party campaign attribution and eligible text-slot experiment assignment after analytics is allowed | Until analytics is withdrawn or site data is cleared; removal ends attribution continuity and may create a new ID after later consent |
| everpacket.feedback-submitted.v1 | Preference | Records only that feedback was completed so the browser is not repeatedly invited; contains no feedback text | Until deleted; removal may allow the feedback invitation to appear again |
| everpacket:app-sidebar-collapsed; everpacket:packet-section-rail-collapsed | Preference | Stores whether the app sidebar and packet section rail are collapsed | Until deleted; removal resets the corresponding layout preferences |
Local storage is not the primary packet database, but removing entitlement or acceptance keys may require online refresh or renewed acceptance before a gated feature works.
5. Session storage
The current code uses session storage for per-tab coordination:
| Key | Purpose | Duration |
|---|---|---|
| everpacket.writer-tab-owner.v1 | Random identity for the editing tab, used to protect against concurrent writers | Current tab session; may survive a reload in the same tab |
| everpacket.writer-tab-unloading.v1 | Marker used to distinguish same-tab navigation from a duplicated tab | Very short; cleared during navigation logic |
| everpacket.activation.free-branch-fallback.v1 | One-navigation marker created after the customer expressly chooses the free branch during activation | Removed after the next applicable navigation |
| everpacket.marketing-session.v1 | Stores a random analytics session UUID and last-touch time after analytics is allowed | Current tab session or about 30 minutes of inactivity; removed when analytics is withdrawn |
| everpacket.marketing-context.v1 | Stores only closed internal attribution identifiers returned by the same-origin analytics service after analytics is allowed | Current tab session; removed when analytics is withdrawn |
| everpacket.feedback-prompt.pending.v1; everpacket.feedback-prompt.seen.v1.<kind> | Stores closed feedback-invitation categories; contains no packet identifier, filename, packet value, or feedback text | Current tab session; ordinarily cleared when the tab or browser session ends |
Session storage is ordinarily cleared when the tab or browser session ends. A browser may behave differently after crash recovery or session restore.
6. First-party and provider-managed cookies
The current EverPacket experience creates, controls, or may receive the following first-party and provider-managed cookies. Provider-managed entries are identified in the table.
| Cookie | Category | Purpose | Current duration / attributes |
|---|---|---|---|
| everpacket-auth-remember | Preference and authentication | Stores whether the user chose persistent (persistent) or session-only (session) authentication cookies | Persistent selection currently lasts up to 400 days; path /; SameSite=Lax; Secure on HTTPS. |
| Supabase authentication cookie(s) | Strictly necessary | Holds or refreshes the authenticated account session | Provider-generated names and durations; made session-only when “remember” is disabled; Secure/HttpOnly/SameSite attributes depend on provider and server configuration |
| everpacket-customer-access.v1 | Strictly necessary account access | Short-lived signed proof that an eligible recovered account belongs to a U.S. customer; contains no packet content | About 30 minutes; HttpOnly; SameSite=Lax; Secure on HTTPS; path / |
| ep_claim | Strictly necessary purchase setup | Contains a purchase-claim ID and secret used only to continue account setup; cannot independently authorize paid features | Up to 30 days; HttpOnly; SameSite=Lax; Secure on HTTPS; path / |
| everpacket_checkout_result | Strictly necessary checkout return | Briefly carries a sanitized checkout-result state to the return page | Approximately 10 minutes; should be Secure and appropriately scoped in production |
| ep_activation_deferred | Strictly necessary purchase setup | Records an explicit free-branch choice for the matching purchase claim | Up to 30 days; HttpOnly; SameSite=Lax; Secure on HTTPS; removed when no longer needed |
| everpacket.account-setup-proof.v1 | Strictly necessary account setup | Short-lived proof used to complete the protected account-setup flow | About 15 minutes; HttpOnly; Secure on HTTPS; appropriately scoped |
| everpacket.account-consolidation-proof.v1 | Strictly necessary account consolidation | Short-lived proof used to complete the protected account-consolidation flow | About 10 minutes; HttpOnly; Secure on HTTPS; scoped to the consolidation route |
| everpacket-analytics-consent.v1 | Optional analytics permission | Server-readable record that the browser allowed optional product and marketing analytics; contains only the closed allowed state | Up to 30 days; HttpOnly; SameSite=Lax; Secure on HTTPS; deleted on denial or withdrawal |
| everpacket-analytics-denial.v1 | Optional analytics denial override | Current analytics consent scope version and closed denied, GPC, or DNT state; written immediately so it overrides older permission offline | Up to 30 days; script-readable and server-readable; SameSite=Lax; Secure on HTTPS; path /; deleted only after a successfully synchronized allowed choice |
| everpacket-marketing-assignment.v1 | Optional experiment assignment | Signed assignment containing only approved experiment, variant, route, slot, manifest, and treatment fields | Up to 30 days; HttpOnly; SameSite=Lax; Secure on HTTPS; deleted on denial or withdrawal and revalidated before use |
| __cf_bm; cf_clearance; _cfuvid (when enabled) | Strictly necessary provider security | Cloudflare bot management, challenge, abuse-prevention, and request-integrity controls | Provider-controlled names, durations, and attributes; present only when the corresponding Cloudflare feature is active |
Provider libraries may split authentication values across multiple cookies. Their exact names and durations may vary with the active authentication configuration.
7. Service worker and Cache Storage
In production, EverPacket registers `/sw.js` and currently uses Cache Storage named `everpacket-shell-v4`. Future application-shell versions use the declared `everpacket-shell-` prefix and remove older versions during service-worker activation. The current service worker is designed to:
-
cache selected public routes and static application resources;
-
support application-shell loading and local work during an outage;
-
avoid caching account, authentication, purchase, checkout, API, and webhook routes; and
-
wait for local saves before activating an available update when the application can do so.
An offline legal or informational page may be older than the live version. The live version presented in checkout controls, and current legal pages identify when an offline copy may be outdated.
Removing Cache Storage may require the application to reconnect and reload before offline use returns. It does not necessarily remove IndexedDB packet contents, but browser “clear site data” controls often remove both.
8. Browser privacy signals
The current application checks:
-
Global Privacy Control (GPC): navigator.globalPrivacyControl; and
-
Do Not Track (DNT): navigator.doNotTrack === "1".
Either signal forces optional product analytics, first-party marketing attribution, and experiment assignment off. The browser may send an append-only, content-blind record containing only the anonymous installation UUID, analytics category, signal decision (gpc or dnt), and analytics consent scope version. A local marker prevents duplicate records for the same version and signal.
GPC and DNT do not disable strictly necessary packet storage, authentication, purchase, legal acceptance, fraud prevention, or security functions.
9. Optional product and marketing analytics requests
The browser parses recognized campaign parameters and immediately removes them from the visible address bar and navigation history. While the analytics choice is undecided, the parsed closed values may be held only in current-page memory; no persistent marketing identifier is created and no marketing request is sent. Denial discards the pending values.
When analytics is allowed, the application may send strictly validated product events to `/api/analytics` and first-party marketing attribution or experiment events to `/api/analytics/events` on the same EverPacket origin. The server validates each request against a separate closed schema before storing or aggregating it.
Product-event fields are limited to an event name, anonymous installation UUID, application version, and, for certain events, one predefined section, preset, sign-in provider, or error code. The product-event schema is designed to reject:
-
packet values, names, phone numbers, addresses, notes, titles, and search text;
-
project files, output bytes, filenames, edition identifiers, and output fingerprints;
-
arbitrary URLs, referrers, query strings, DOM content, clipboard content, and exception messages; and
-
arbitrary properties or free text.
First-party marketing records may include random visitor and session UUIDs; a bounded page pathname without a query string; landing-page version; normalized source, medium, campaign, content, paid-search term, and affiliate values; opaque tracking, campaign, creative, attribution, landing-page, experiment, and variant identifiers; coarse referrer, device, and browser categories; CTA category and placement; and a closed route, surface, slot, manifest, or exposure record. The marketing schema rejects account email, account ID, packet fields, names, contact details, notes, filenames, output contents, full URLs, raw referrer URLs, DOM capture, session replay, exception messages, and other arbitrary or free-text properties.
First-party campaign attribution ordinarily uses a 30-day attribution window. Raw first-party marketing attribution, exposure, checkout-context, and experiment records may be retained on the server for up to 13 months so configured conversion and refund or dispute guardrail windows can mature; the combined experiment duration and follow-up horizons must fit within that period. Completed aggregate metrics and experiment-decision snapshots may be retained for up to 25 months, or longer only after verification that they are truly anonymous. A signed experiment assignment may remain in its browser cookie for up to 30 days but is revalidated before use. Denial, withdrawal, GPC, or DNT stops future optional requests and clears the local marketing visitor, session, context, and assignment state.
When EverPacket connects its own advertising accounts, the Meta and Google reporting integrations import aggregate campaign or advertisement identifiers, spend, impressions, clicks, and provider-reported conversion totals. At initial launch, EverPacket does not upload EverPacket account email, account identifiers, visitor identifiers, purchase identities, or packet information to Meta or Google through this reporting sync.
Product and marketing analytics are incomplete by design and are not used as authoritative payment, entitlement, legal-acceptance, or refund evidence.
10. Third-party storage
10.1 Payment Merchant
The hosted checkout and receipt pages may use cookies or local storage for payment, Link account functions, fraud prevention, tax, security, and preferences under the Payment Merchant's notice. EverPacket does not control those technologies.
10.2 Identity providers
Google, Meta/Facebook, and Microsoft may use their own cookies and device storage when you select an enabled sign-in option. A provider button may be temporarily unavailable while its production configuration or provider review is incomplete. No sign-in data is sent to a provider that you do not select. The provider’s notice and account settings apply.
10.3 Infrastructure
Cloudflare, Supabase, and Resend may process request, approximate-country, security, authentication, database, support, consent, marketing, and email-delivery information on the server side. Their server logs are not browser cookies stored by EverPacket, though their services may cause or manage first-party authentication or security values.
On the unsupported-country flow, optional product and marketing analytics, marketing identifiers, and experiment assignments remain off at initial launch. A Cloudflare-provided country signal may be used to route or prefill the page, and an interest action increments only an unlinked country-level aggregate without an email address or EverPacket account identifier. Ordinary outbound social links do not embed a social pixel, widget, feed, or tracking SDK on the EverPacket page.
10.4 Advertising-platform reporting
EverPacket may connect its own Meta and Google advertising accounts to read aggregate campaign delivery and spend information. Those provider dashboards and authorization pages may use their own cookies or device storage under their notices. EverPacket does not place a Meta pixel, Google advertising tag, customer-list audience, or cross-site behavioral-advertising cookie on EverPacket-controlled pages at initial launch.
11. Managing storage
You can use EverPacket settings, browser controls, or operating-system controls to:
-
allow or deny optional analytics;
-
send GPC or DNT where supported;
-
choose persistent or session-only sign-in;
-
sign out or revoke sessions;
-
delete an individual packet in the app;
-
delete the EverPacket account; or
-
clear cookies, local storage, IndexedDB, and Cache Storage.
Before clearing site data:
-
finish pending local saves;
-
export a current .EverPacket project file for each packet you need;
-
verify the downloaded file exists and opens through an import preview;
-
understand that the file itself is not encrypted by EverPacket; and
-
remember that account deletion and browser-data deletion are separate actions.
Browser controls vary. Some “clear cookies” actions also remove IndexedDB and Cache Storage. Private or guest sessions may erase data automatically when closed.
12. Consent and withdrawal
Strictly necessary storage is used because the Service cannot provide the requested local packet, account, purchase, security, or legal function without it. Where local law requires consent for a preference or analytics technology, the technology remains off until valid consent.
You may withdraw optional analytics permission at any time. Withdrawal stops future product analytics, marketing attribution, and experiment requests; removes or disables the local marketing visitor, session, context, consent-cookie, and assignment-cookie state; and does not block editing, output generation, checkout, account access, recovery, or support. Withdrawal does not invalidate prior lawful processing or remove transaction and legal records needed for another purpose. A privacy request may be used to seek deletion of applicable server-side consent, product-event, or marketing-event records subject to legal exceptions.
13. Changes
EverPacket keeps three version dimensions separate. cookieInventoryVersion changes whenever a cookie, device-storage key, duration, or technical description changes. legalNoticeVersion identifies the published version of this Notice. analyticsConsentScopeVersion changes only when the user’s optional-analytics permission must cover a new purpose, recipient, materially broader data category or use, materially longer retention, or materially different tracking behavior.
For an inventory-only or clarifying or administrative change, EverPacket updates and publishes this Notice with its effective date, preserves the prior Notice in the archive, preserves existing optional-analytics consent, and does not ordinarily email users or show the consent interface again. If the existing consent was not broad enough to cover the purpose, the change is not inventory-only.
Before enabling a new optional purpose or recipient or a material expansion of data use, retention, or tracking behavior, EverPacket updates the applicable notices and consent interface, changes analyticsConsentScopeVersion, and asks returning users again before the new optional technology runs. EverPacket evaluates separately whether direct notice is required; a consent-interface re-prompt does not automatically require a mass email.
A material retroactive use requires direct notice and fresh affirmative consent. EverPacket does not apply the broader new practice to previously collected information until the user agrees. Disclosing prior analytics records to a new advertising recipient or using them for unrelated profiling is not a cookie-name change.
EverPacket reviews this Notice when the release, storage inventory, authentication configuration, Payment Merchant integration, analytics behavior, or browser network activity materially changes.
14. Contact
Privacy questions: privacy@everpacket.com
Product support: support@everpacket.com
Kimi Chen d/b/a EverPacket
8843 Villa La Jolla Drive Apt 2, La Jolla, CA 92037
San Diego, California, USA