Cookie Policy

This Cookie Policy explains how Toran Inc., a Delaware corporation with its principal place of business in Washington, USA (“Toran”), uses cookies and similar browser-side storage when you visit mytoran.com. It should be read alongside our Privacy Policy.

1. What Are Cookies?

Cookies are small text files that a website asks your browser to store. They allow the site to remember information about your visit — such as whether you are signed in or which theme you have chosen — across page loads and sessions.

Toran also uses two other browser-side stores: localStorage (persistent, per-domain) and sessionStorage (cleared when you close the tab). Data placed in these stores is not transmitted to our servers automatically.

2. What Toran Uses Today

Strictly necessary — required for Toran to function

• Supabase authentication cookies (names follow the pattern sb-<project-ref>-auth-token and related variants). Set by our authentication provider, Supabase, when you sign in. They contain a short-lived JSON Web Token (JWT) access token and a refresh token, used exclusively to authenticate your requests to Toran. They expire on the schedule configured by Supabase Auth. Disabling these will prevent you from signing in.

Functional — improve your experience but not required

• Theme preference cookie (theme): a first-party cookie that records whether you chose light or dark mode, so the server can render the correct theme on first paint. The same value is also stored in localStorage. No personal data.
• Tooltip and onboarding state (localStorage keys for first visit and tooltip dismissal): records that you have seen and dismissed certain interface tooltips, so we don't show them again.
• Last visited route (sessionStorage): the most recent URL you visited within Toran, used to support back-navigation. Cleared when you close the tab.

Toran does not currently use analytics cookies, advertising cookies, social-media trackers, or third-party tracking pixels of any kind. We do not currently run Google Analytics, Mixpanel, Amplitude, Segment, PostHog, Sentry, or similar tools.

3. Third-Party Cookies

The only third-party cookies present on mytoran.com are the Supabase authentication cookies described above (Supabase being our authentication and database provider).

When you use our AI design tools, your room images are processed by third-party AI inference providers (Replicate, FAL.ai, OpenAI, Anthropic — see our Privacy Policy, Section 3). These APIs do not set cookies in your browser.

4. Managing Cookies and Local Storage

You can control cookies through your browser settings. Common paths:

• Chrome: Settings → Privacy and security → Cookies and other site data
• Firefox: Settings → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Manage Website Data
• Edge: Settings → Cookies and site permissions → Cookies and site data

Most browsers also offer a setting that clears localStorage and sessionStorage when you clear cookies and site data.

Note: disabling the strictly necessary authentication cookies will prevent you from signing in to Toran. The functional theme and onboarding entries can be cleared at any time without affecting core functionality.

Do Not Track and Global Privacy Control

Toran does not currently respond differently to the legacy “Do Not Track” header, and we are working to honour the Global Privacy Control (Sec-GPC) browser signal at the application layer. Until that is implemented, please refer to the email-based opt-out path described in our Privacy Policy. We do not sell or share personal data for cross-context behavioural advertising under any circumstances.

5. Changes to This Policy

We will update this policy if we add new cookies or browser-side storage. For material changes, we will notify users via email or an in-app notice at least 14 days before the change takes effect.

6. Contact

Questions about our cookie practices? Email us at support@mytoran.com.