Cookie Policy
effective November 10, 2026version 2026-11-10
This policy explains the cookies and similar storage that sable.salon and app.sable.salon use. Cookies are small files your browser keeps for a website. We group ours by what they do.
Essential
Needed for Sable to work, so they can't be turned off: signing you in and keeping you signed in, completing two-step verification, remembering a front-desk device in Salon Mode, remembering a client who has verified a booking on that device, remembering your cookie choice, and payment fraud prevention by Stripe on pages that take or set up payments.
Preferences
Remember choices you make, like light or dark appearance and whether the sidebar is open.
Analytics
Help us understand how Sable is used: PostHog in the Sable app, Google Analytics on sable.salon, and a cookie that remembers how you found Sable when you sign up. PostHog is part of using the Sable app and runs once you've accepted the Terms of Service and Privacy Policy; it acts only as our service provider and is never used for advertising or to follow you across other sites. Google Analytics and the sign-up cookie are used only if you haven't declined on sable.salon, and never when your browser sends a Global Privacy Control signal.
On sable.salon, Google Analytics is loaded through Google Tag Manager, and Tag Manager loads nothing else. Google Analytics is set up so Google uses the data only to give us reports, not for advertising. Tag Manager does not load at all once you decline or if your browser sends a Global Privacy Control signal, and advertising storage is always off. Before we add any other tag, we will update this policy and ask again where the law requires it.
Every cookie we use
| Name | Set by | Purpose | Kept for | Type |
|---|---|---|---|---|
| __Secure-better-auth.session_token | Sable | Keeps you signed in | 7 days | Essential |
| __Secure-better-auth.session_data | Sable | Checks your sign-in quickly | 1 hour | Essential |
| __Secure-better-auth.state | Sable | Keeps your Google sign-in secure while you're sent to Google and back | 5 minutes | Essential |
| __Secure-better-auth.trust_device | Sable | Skips two-step verification on a device you chose to trust | 30 days | Essential |
| Two-step verification cookie | Sable | Completes two-step sign-in | Minutes | Essential |
| sable:legal-tick | Sable | Remembers you ticked the terms while you finish signing up (kept in the tab, not a cookie) | Until you close the tab | Essential |
| sable_salon_device, sable-salon-mode | Sable | Front-desk device in Salon Mode | 1 year | Essential |
| sable-booking-device | Sable | Remembers a client who verified on this device | 30 days | Essential |
| sable_cookie_choice | Sable | Remembers your cookie choice | 1 year | Essential |
| __stripe_mid, __stripe_sid | Stripe | Payment fraud prevention | 1 year / 30 minutes | Essential |
| sable-appearance | Sable | Appearance | 1 year | Preferences |
| sidebar_state | Sable | Whether the sidebar is open | 7 days | Preferences |
| ph_* | PostHog | Product analytics in the app | 1 year | Analytics |
| _ga, _ga_* | Visits to sable.salon | Up to 2 years | Analytics | |
| sable_attribution | Sable | How you found Sable, when you sign up | 90 days | Analytics |
The app also keeps a few things in your browser's local storage, such as recent searches and a form you haven't finished, so they're there when you come back. Some settings, such as calendar preferences, are also saved to your account so they follow you to your other devices.
Your choices
The first time you visit sable.salon, we ask whether to allow analytics there, with "allow" and "decline" side by side. You can change your answer at any time from "cookie settings" at the bottom of sable.salon. If your browser sends a Global Privacy Control signal, we treat it as a decline on sable.salon and cookie settings show that the signal was honored. Product analytics in the Sable app and the iOS app are part of using them and can't be turned off. We don't sell or share that information or use it for advertising, so a Global Privacy Control signal doesn't change it. You can also delete cookies in your browser settings, but you'll need to sign in again.
When we add, remove or change a cookie, we update the list above and the date at the top of this page first.
Questions? Email support@sable.salon.