Cookie Policy
This page explains the cookies and similar local-storage technologies Sous-Chef uses, what each one does, and how to manage them. We aim to keep this list short and to use only what we need to deliver the service.
What is a cookie?
A cookie is a small text file that a website asks your browser to store and return on later visits. We also use the related browser APIs localStorage and sessionStorage in similar ways. We refer to all of these collectively as "cookies" on this page.
Categories we use
The cookie banner offers the same two categories: Always on and Analytics.
1. Always on
Keeps you signed in, protects sign-in and signing links, and remembers your settings (theme, sidebar layout, the plan you picked). These can't be turned off here. You can clear them in your browser, but sign-in then stops working.
On the live site, the cookies our sign-in system sets start with __Secure- (for example __Secure-timely.session_token). The names below leave it out.
| Name | Purpose | Lifetime |
|---|---|---|
| timely.session_token | Keeps you signed in | 24 hours at most. It ends sooner after 8 hours without use, or 4 hours for people who work in a consultancy practice |
| timely.two_factor | Holds your place while you finish the second sign-in step | 10 minutes |
| timely.trust_device | Only if you tick “remember this device” at the second step: lets that browser skip the sign-in code | 14 days |
| timely.better-auth-passkey | Holds a one-time challenge while a passkey is set up or used | 5 minutes |
| timely.known_device | Recognises a browser you have signed in from before, so a sign-in from a new one can be flagged. Set only for people who work in a consultancy practice | 400 days, renewed each time you sign in |
| timely.notice | After you enter the emailed code to open a hearing notice, lets the notice reload without another code | 30 minutes |
| timely.sign.<contract id> | After you enter the one-time code to sign a contract, lets the signing page reload without another code. Sent only to that signing page | 1 hour |
| timely_cookie_consent | Remembers your cookie choice | 1 year, or until you use Cookie settings |
| sidebar_state | Remembers whether the sidebar is open | 7 days |
| oc_pricing_plan | Remembers the plan you picked on the pricing section or during sign-up, so the next step shows it | Up to 7 days (1 hour when set during sign-up) |
| oc_billing_cycle | Remembers the billing cycle you picked during sign-up | 1 hour |
| theme | Remembers your light/dark preference (localStorage) | Until you clear it |
| cf_clearance (may be set) | Cloudflare may set this when it checks a registration, login or password-reset form for bots. Cloudflare sets it, not us | Set by Cloudflare |
A few screens also keep display settings in your browser's local storage: the contract editor's view settings, which help guides you have read, and whether you dismissed the onboarding tour.
2. Analytics
With your consent we use PostHog to understand which features are used so we can improve the product. This category is off by default: until you turn it on, PostHog records no events about what you do in the service. Its script still loads on every page and keeps a random device identifier in your browser (the cookie below). You can withdraw consent at any time with Cookie settings (see “How to manage cookies” below), after which PostHog stops recording what you do. Once you opt in, we identify you to PostHog by the internal ID of your account and your organisation ID only — never your name or email address — and analytics traffic from your browser is sent first-party through our own domain (/ingest). Separately, our servers send PostHog reports of errors. PostHog acts as a processor of this usage data on our behalf; see our sub-processors list.
| Name | Purpose | Lifetime |
|---|---|---|
| ph_*_posthog | PostHog analytics — set by PostHog's script when a page loads. Until you opt in it holds only a random device identifier; once you opt in and sign in, it is linked to your account's internal ID | Up to 1 year |
Advertising
We do not run advertising or third-party marketing pixels (for example, Meta Pixel, Google Ads tags) on the application or the marketing site, so there is no advertising category to switch on.
Changes to this policy
We update this page when we add or remove cookies. The version number and effective date at the top of this page change with each update.
Privacy questions: sous.chef.south.africa@gmail.com. Full privacy policy: /legal/privacy.