cookie policy

Cookies are small pieces of data a website stores in your browser. They help the site remember who you are between page loads so you don't have to sign in again every time. Related technologies (local storage, session storage, service worker caches) behave similarly and are covered by this policy.

These are required for the service to work. You can't opt out of them; if you block them, parts of SpotHOA will stop functioning.

• Stytch session cookies (stytch_session, stytch_session_jwt): keep you signed in. They are first-party cookies on spothoa.com that hold the session tokens issued by Stytch, our authentication provider. They last up to 30 days or until you sign out.
• Stytch sign-in security cookies (stytch_csrf_private_token, __Host-stytch_csrf_private_token): when the sign-in page loads, Stytch sets these on its own domains to protect the sign-in request against cross-site request forgery. They are third-party cookies and expire after 10 minutes. Stytch's sign-in code also keeps its state in local storage.
• Cloudflare Turnstile: temporary challenge token on public forms (demo requests, newsletter, feedback, feature requests, directory suggestions) so we can tell humans from bots without tracking you.

These aren't strictly required, and the site still works if you block them. They are set on spothoa.com or its subdomains, none comes from an advertising or analytics company, and some use local storage or session storage instead of cookies.

• Return-path cookie (spothoa_claim_return): if you open an invitation, directory claim, join, account-data or start-your-HOA link while signed out, it remembers that page for 30 minutes so you land there after you sign in. It holds only the page address and stays on the device you used.
• Terms acceptance cookie (spothoa_terms): set when you sign up, it carries the version of the Terms and Privacy Policy you agreed to until we record it on your account. It expires after one hour at most.
• Dismissed banners: once you dismiss the mobile install banner or narrow-viewport tip, we store the dismissal in local storage so it doesn't reappear.
• List layout: the tiles or table layout you pick for the Units page in an HOA portal is stored in local storage.
• Click-around demo: the sample at /demo keeps the sample data you change in session storage so it survives a page reload. It stays in your browser and is cleared when you close the tab.
• Confirmation messages (spothoa_flash): after some actions this cookie lasts up to one minute so the next page can show a one-time confirmation or error message. It holds a message key, nothing personal.
• Setup reminder (spothoa_routed_to_setup_at): after you open your HOA's setup checklist, this cookie holds a timestamp for one hour so the dashboard doesn't keep sending you back to it.
• Campaign attribution (spothoa_utm): if you arrive through a link with campaign tags (utm_source, utm_medium, utm_campaign, utm_content), we keep those labels for 90 days so we know which flyer, card or link brought you to us. When you create an account we copy them to your account record, once, and delete the cookie. They are not shared with advertising or analytics companies.
• Homepage headline test (spothoa_hero_arm): we test different homepage headlines. This cookie holds one letter (A, B or C) for 90 days so you see the same version each visit. Our server counts how often each version is shown and clicked, with the page path, referrer and browser user agent, without tying the counts to you. If you create an account, the letter is also saved on your account record so we can see which version led to sign-ups.

SpotHOA does not set:

• Third-party analytics cookies (no Google Analytics, no Microsoft Clarity, no Mixpanel) and no session recording.
• Advertising or retargeting cookies, or ad-network conversion tags (no Google Ads tag, no Meta or Facebook pixel).
• Third-party social-media cookies (no Facebook pixel, no Twitter pixel).

We measure traffic with Cloudflare Web Analytics. It sets no cookies, uses no local storage and, per Cloudflare's documentation, collects no personal data. The only measurement cookies we set ourselves are the first-party campaign-attribution and headline-test cookies described above.

Email works differently from cookies. We send transactional email through Resend, which reports delivery status back to us (sent, delivered, delayed, bounced, or marked as spam) so a board can see whether a notice reached its recipients. We do not track whether you open an email or click a link.

All modern browsers let you inspect, clear, or block cookies per site. The shortcuts below are the common ones (menus change over time):

• Chrome: Settings → Privacy and security → Cookies and other site data.
• Safari: Settings → Privacy → Manage Website Data.
• Firefox: Settings → Privacy & Security → Cookies and Site Data.
• Edge: Settings → Cookies and site permissions → Manage and delete cookies and site data.

If you block the Stytch session cookies, you'll be signed out. If you block Turnstile, public forms will fail their bot check. Everything else is optional: without the return-path cookie, for example, an invitation link lands you on your dashboard after sign-in instead of the page you opened.

For the broader picture of what data SpotHOA collects and how we use it, see the Privacy Policy. Cookie-related questions can go to privacy@spothoa.com.