KBB Render
Cookie Policy
This policy explains how KBB Render uses cookies and similar browser technologies on our website and application, and how those technologies relate to your account and the features you use.
Working draft · 12 October 2026Scope: The storage inventory below is based on information supplied by the KBB Render development team about the application. The WordPress marketing website and its plugins still need a live cookie and script audit, so this is a working draft and should be checked before publication.
1. About this policy
This Cookie Policy applies to kbbrender.com and the KBB Render application at app.kbbrender.com. It should be read alongside our Privacy Policy.
“Cookies and similar technologies” includes browser cookies, local storage, session storage and other technologies that store information on, or access information from, your device. Some are needed for sign-in, security and features you request. Optional analytics or advertising technologies should only be used where enabled and after any required consent.
2. Cookies and browser storage
A cookie is a small file saved by your browser. Local storage and session storage are browser areas that a website or application can use to remember information. Local storage usually remains until it is cleared, while session storage is normally cleared when the tab or browser session ends.
Our application uses browser storage for authentication and to remember the state of product workflows. These entries are not all cookies, but they are included here because they store information on your device.
3. Essential technologies
Some browser storage supports the account, security or product feature you ask us to provide. The development team has described the following authentication design:
- An access JWT is stored in local storage as
tokenand is valid for 30 minutes. It is used for authenticated API requests and is cleared at logout. - A non-sensitive profile object is stored as
userand cleared at logout. - A rotating refresh-token cookie named
kbb_rtis described as HttpOnly, Secure and SameSite=Lax, with a 30-day lifetime and a path of/api/auth. In production, the reported domain is.kbbrender.com. Some of these details were still awaiting production rollout in the development update, so the live configuration must be checked before this description is published.
4. Application storage inventory
The table lists application storage names and purposes reported by the development team. Some entries are temporary workflow data; entries may be cleared sooner when the related task completes.
| Name | Storage | Purpose | Reported lifetime or clearing |
|---|---|---|---|
kbb_rt | Cookie | Rotating authentication refresh token | 30 days, rotates on use; production attributes require verification |
token | localStorage | Short-lived access JWT for authenticated requests | JWT valid for 30 minutes; cleared on logout |
user | localStorage | Non-sensitive account profile for the interface | Cleared on logout |
kbb_guest_token | localStorage | Guest identity for the free-render funnel | Server-managed, approximately 30 days |
kbb_selected_project_id | localStorage | Remembers the last selected workbench project | Until the project is deselected |
kbb_guest_render_id | localStorage | Tracks a guest render in the funnel | Cleared when the render completes or fails |
kbb_guest_preset_try | localStorage | Stores a preset and its reveal timer | Cleared when the reveal occurs |
kbb_snoozed_announcements | localStorage | Remembers announcement snooze choices | 24 hours for each entry |
pending_guest_render_id | localStorage | Carries a guest render through signup so it can be claimed | Cleared after successful authentication |
verification_email, verification_code | localStorage | Temporary email and verification flow state; code auto-fill was described as development-only | Cleared after verification; ensure development-only code storage is disabled in production |
selected_plan, selected_billing | localStorage | Carries selected plan and billing period through signup | Cleared after checkout redirect |
pending_invite_token | localStorage | Applies a team invitation after verification | Cleared after verification |
kbb_pending_animation_id, kbb_pending_animation_form | sessionStorage | Preserves animation workflow data across a Stripe checkout redirect | Session only; cleared when consumed or when the tab/session closes |
Clearing browser storage can sign you out or remove an in-progress workflow. The exact entries and behaviour may change as the application is updated.
5. Analytics, attribution and advertising
In the development information provided on 10 October 2026, Google Analytics, Google Tag Manager and PostHog were not installed in the application. PostHog was described as a possible future service, not an active integration. The team also said that no app usage analytics or traffic-source attribution was then captured in the application, other than the free-render funnel details below.
The free-render funnel was reported to capture the UTM fields utm_source, utm_medium, utm_campaign, utm_term, utm_content and the referrer, and send them to the backend without a consent gate. The team planned to gate this capture. The change must be confirmed as deployed before this policy is updated to say that attribution is consent-gated.
This app inventory does not confirm what scripts, pixels, cookies or browser storage are used on the WordPress marketing website. That site must be checked separately before listing analytics, advertising providers, cookie names, purposes or lifetimes.
If optional analytics or advertising technologies are introduced, we should update this policy and configure the consent controls before enabling them where consent is required. Any future PostHog setup was proposed to start with autocapture, session replay, surveys and server-side analytics disabled, and only activate after Analytics consent. This is a proposal, not a current app feature.
6. Your choices
Your browser settings let you view, block or delete cookies and clear local or session storage. If you block essential storage, sign-in or parts of the service may not work. Clearing storage can also remove in-progress work or sign you out.
At the time of this draft, the development team had not confirmed a live shared cookie-settings control across kbbrender.com and app.kbbrender.com. Before optional tracking is enabled, KBB Render should provide a clear choice and a simple way to change or withdraw that choice, then update this section with the actual controls and preference-storage details.
For help, contact info@kbbrender.com.
7. Changes and contact
We may update this policy as our website, application or technology changes. We will update the date and, where appropriate, explain material changes.
Questions about this policy can be sent to info@kbbrender.com.
Last reviewed: 12 October 2026. This draft reflects application details supplied by the development team on 10 October 2026 and still requires the website scan and production verification described above.