Cookie Notice
This notice lists every cookie and every piece of browser storage Behavly uses. There are two very different situations: our own website and application, and the tracking snippet our customers install on their sites.
Last updated 26 October 2026
2.On our own site and application
Some cookies are strictly necessary to sign you in and to keep the application working. They are always on:
| Cookie | Purpose | Lifetime |
|---|---|---|
| sb-…-auth-token | Keeps you signed in. Set by our authentication provider (Supabase) after you log in. May be split across several numbered cookies. | Session, refreshed while you use the application |
| active_team_id | Remembers which Workspace you are working in when you belong to more than one. | 1 year |
| bv_terms | Carries your acceptance of the Terms from the sign-up page through the Google or Microsoft sign-in round trip, so it can be recorded on your new account. | 10 minutes, removed after sign-up completes |
| bv_cookie_consent | Remembers your answer to our cookie banner, so the banner does not ask again and our server knows whether advertising measurement is allowed. A copy of the answer is also kept in your browser’s local storage. | 1 year |
Advertising cookies (only if you allow them). We advertise Behavly on Facebook and Instagram and use the Meta Pixel, a script from Meta Platforms Ireland Limited, to measure how those ads perform. Nothing from Meta loads, and none of these cookies is set, unless you click Allow All in our cookie banner. If you click Deny, or make no choice, they are never set.
| Cookie | Purpose | Lifetime |
|---|---|---|
| _fbp | Set by the Meta Pixel. A random identifier Meta uses to tell which of our ads on Facebook and Instagram brought you to our site, and whether you then signed up or bought a plan. | 90 days |
| _fbc | Set by the Meta Pixel when you arrive by clicking one of our Meta ads. It holds that ad click’s identifier, for the same measurement. | 90 days |
| bv_meta_event | Set by our server when you create an account, so the page you land on can report that sign-up to Meta once. Removed as soon as it has been read. | 10 minutes |
When advertising cookies are allowed:
- on our public website, the Meta Pixel tells Meta which page you viewed;
- when you create an account or buy a plan, the Meta Pixel and our server each tell Meta that this happened (our server uses Meta’s Conversions API). Meta keeps one of the two copies. With it our server sends your email address and account identifier in hashed form (scrambled with SHA-256 so they cannot be read back), your IP address, your browser type, the plan’s price and the two Meta cookies above;
- inside the application the Meta Pixel reports only those two events. It does not report the pages you open there.
Meta uses this to match the event to an ad it showed you and to report to us how our ads perform. Who is responsible for this data is set out in section 6 of our Privacy Policy. Meta’s own use of the data is described in its Privacy Policy.
The application may also keep interface preferences, such as whether a panel is open, in your browser’s local storage. These never leave your browser and hold no personal data.
3.The Behavly snippet on customers’ websites
When a customer installs the Snippet on its own website or product, the Snippet records how that customer’s logged-in users behave. The customer is the controller of that data and is responsible for the notice or consent its law requires; Behavly acts as the customer’s processor. The Snippet:
- sets no cookies. It keeps a random identifier and the link to the identified user in the site’s localStorage, and short-lived heatmap data in sessionStorage. This storage belongs to the customer’s domain, not to Behavly’s.
- stops immediately when the browser sends the Global Privacy Control or Do Not Track signal.
- offers a consent function the customer’s site can call to start or stop recording according to its own consent banner.
- ignores known bots and crawlers so that automated traffic is not recorded.
To stop the Snippet from recording you on a customer’s site, use that site’s own privacy controls, enable Global Privacy Control in your browser, or clear the site’s storage.
4.Email tracking
Emails sent through Behavly contain a one-pixel tracking image that records when the email is opened, and links that pass through Behavly to record clicks before redirecting. These are not cookies and place nothing in your browser. Every such email carries an unsubscribe link.
5.Your choices
You can change your answer about advertising cookies at any time, here. Turning them off stops the Meta Pixel straight away and removes its cookies from this browser.
You can also block or delete cookies in your browser at any time. Blocking the sign-in cookie means you cannot stay logged in to Behavly. Details of how we process the data behind these technologies are in the Privacy Policy.
6.Changes and contact
We will update this notice whenever the cookies or storage we use change. Questions: hello@behavly.io.