Cookie policy

uier.io uses cookies and browser storage for the actions and preferences listed below. None of them is set when you only read the site, and none is used for advertising or to follow you to other sites.

What we store

• uier:environment:v1:<api>:<project>:<reviewer>Local storage

  Set when

  You choose an environment filter in the project inbox

  Purpose

  Remembers the selected environment or history view for this project and reviewer on this site. It contains no comment text, image or authentication token.

  Kept for

  Until you clear your browser data

• uier:draft:v1:<scope>:<item>Local storage

  Set when

  You start or change a feedback draft

  Purpose

  Restores unsent text, its anchor, the original text of an edit and a submission identity, scoped to the project, reviewer and page. Images are never stored here. Discard, posting and toolbar sign-out clear relevant drafts.

  Kept for

  Seven days after the last change; expired data is removed when the toolbar next opens

• uier:visitorLocal storage

  Set when

  You start a draft on uier.io, or open a project review

  Purpose

  Keeps a random guest identity stable if a submission response is lost. An existing visitor cookie takes precedence. Toolbar sign-out removes it.

  Kept for

  Until toolbar sign-out or you clear your browser data

• uier_visitorCookie (first party, HttpOnly)

  Set when

  Your first comment, reply or read acknowledgement

  Purpose

  Recognises your comments and read state, so only you can resolve or delete your comments. Holds a random token; the server stores only its hash.

  Kept for

  One year

• uier_sessionCookie (first party, HttpOnly)

  Set when

  You sign in to the app

  Purpose

  Keeps you signed in and identifies your feedback on uier.io by your account name, taking precedence over a guest identity. Holds a signed token with your account id; signing out in the app removes it.

  Kept for

  30 days

• uier_review_ssoCookie (HttpOnly, Secure, SameSite=None)

  Set when

  You sign in or visit the signed-in app

  Purpose

  Lets an empty uier frame sign you into a project on a configured site when your browser allows cross-site cookies. It cannot sign you into the app. The server checks your current project access; signing out of the app removes it.

  Kept for

  Until the app session expires, at most 30 days

• uier_workspaceCookie (first party, HttpOnly)

  Set when

  You switch to another workspace in the app

  Purpose

  Remembers which workspace the app shows.

  Kept for

  One year

• uier:showcase-hint-dismissedLocal storage

  Set when

  You close the “Try uier on this page” hint

  Purpose

  Keeps the hint closed on your next visit.

  Kept for

  Until you clear your browser data

• uier:toolbar-position:v1Local storage

  Set when

  You move the toolbar

  Purpose

  Remembers its position on this site. Reset toolbar position removes it.

  Kept for

  Until reset or you clear your browser data

• uier:panel-side:v1:<panel>Local storage

  Set when

  You move a panel to the other side

  Purpose

  Remembers the preferred side for each panel on this site.

  Kept for

  Until you clear your browser data

• uier:review and uier:toolbar-collapsedSession storage

  Set when

  You start a review or collapse the toolbar

  Purpose

  Keeps the review active and remembers whether page comments are hidden in this tab.

  Kept for

  For the browser tab

• themeLocal storage

  Set when

  You switch the theme on the brand page or in the app

  Purpose

  Remembers light, dark or system.

  Kept for

  Until you clear your browser data

All of them are needed for something you chose to do, so we do not ask for consent first. The cookies are HttpOnly (scripts on the page cannot read them), Secureand SameSite=Lax, except the separate background sign-in cookie described above, which uses SameSite=None and is restricted to the review API.

On sites that use uier

When you review a site that embeds the uier toolbar for a project, the toolbar keeps these keys in that site’s local storage once you open a review link, comment or sign in automatically. The toolbar’s Sign out removes the identity keys. Background sign-in uses an empty frame on uier.io and the separate cookie above to check your existing account and project access. Blocked cookies or frames leave the explicit sign-in link available. We do not open popups or ask for storage access. Before writing, an empty frame on uier.io verifies your browser with BotID. Its signed proof lasts five minutes and is kept only in memory. This needs no third-party cookies.

• uier:review-token:<project>: keeps you signed in to the project on that site (30 days).
• uier:visitor: a random id that recognises a guest’s comments and read state. Read state is limited to this browser and site; clearing the id starts a new identity.
• uier:guest-name: the name a guest comments under.
• uier:review-code:v1:<api>:<project> (session storage): a pending one-use sign-in code, saved before URL removal so a host redirect cannot lose it. It expires after ten minutes and is cleared after exchange, definitive rejection or toolbar sign-out.
• uier:auto-sign-in-disabled:<api>:<project> (local storage): remembers toolbar sign-out until you use an explicit authenticated review link.
• uier:review-exited (session storage): prevents automatic reopening after Exit review in this tab, until you use a review link.

Drafts, toolbar position and panel-side preferences are also stored on reviewed sites. Drafts expire after seven days; signing out clears that reviewer’s drafts for the project on that site. Signing out removes the identity keys listed above; the automatic sign-in opt-out, movement and environment filter preferences remain until reset or you clear site data. Signing out of the app stops future background sign-ins; project review tokens already stored on other sites last until they expire or you sign out in those toolbars.

Third parties

Vercel Web Analytics, which counts page views, and Vercel BotID, which checks that comments come from people, set no cookies and store nothing in your browser. No other third party loads on uier.io. The privacy policy explains what they process.

Removing them

You can delete cookies and site data in your browser settings at any time. If you delete the uier_visitor cookie and uier:visitor local storage, the server can no longer tell that your earlier comments are yours: you will not be able to resolve or delete them, and your next comment starts a new guest name. Visitor threads stay public until they expire 90 days after their last change, or until you ask us to remove them. Replies to our starter threads stay with the thread unless you delete them or ask us to remove them. If you delete the uier_session cookie, you are signed out of the app.

Contact

Questions about this policy: gdpr@signalco.io.

Selected @mentions in an unsent draft also keep the participant’s opaque account id and its range in the draft text. They use the same seven-day draft record, reviewer and page scope, discard controls and sign-out clearing described above. No email address is added to the draft.