Mailwright

Cookie Policy

Effective 2026-10-11Draft for legal review — not an approved contract

Draft for legal review — not an approved contract. Effective 2026-10-11. The operator’s legal name, address, and governing law are blank because they are not in the product.

All documents

1. Status of this draft

This draft lists the cookies and similar storage the product sets. It is not an approved cookie policy. Operator legal name and address are blank.

Not stated in the product, and not filled in by this draft: the operator’s legal name, registered address, governing law, and court. A lawyer has to supply them. Do not treat this page as a signed contract.

2. What is covered

A cookie is a small value the browser stores for this site. The product also uses local storage for the access check, the session copy used by the browser, and the cookie notices. Those are not cookies, and they are listed because they remember a choice on the device.

3. Cookies

Cookies set by this application

Name	Purpose	Lifetime	Notes
mw_session	Session token for the signed-in account	Default 180 days, matching the session	httpOnly, SameSite=Lax, Secure in production. Cleared on sign-out.
mw_auth	Flag that this browser has a session, so public pages can stay public and app pages can ask you to sign in	Same as the session	Not httpOnly. The value is 1. It is not the session token and it is not an advertising cookie.
mw_gate	Remembers that this browser passed the access-code check	1 year	Set from the browser when the access token is stored. SameSite=Lax. Not an advertising cookie.
mw_currency	Display currency for prices	1 year	Set when a currency is chosen. Prices in a local currency are estimates. Base currency in the product is USD.

Name. mw_session
Purpose. Session token for the signed-in account
Lifetime. Default 180 days, matching the session
Notes. httpOnly, SameSite=Lax, Secure in production. Cleared on sign-out.
Name. mw_auth
Purpose. Flag that this browser has a session, so public pages can stay public and app pages can ask you to sign in
Lifetime. Same as the session
Notes. Not httpOnly. The value is 1. It is not the session token and it is not an advertising cookie.
Name. mw_gate
Purpose. Remembers that this browser passed the access-code check
Lifetime. 1 year
Notes. Set from the browser when the access token is stored. SameSite=Lax. Not an advertising cookie.
Name. mw_currency
Purpose. Display currency for prices
Lifetime. 1 year
Notes. Set when a currency is chosen. Prices in a local currency are estimates. Base currency in the product is USD.

4. Local storage

mw_cookie_choice — the public cookie notice stores “essential” after you choose. It stays in this browser and is not sent to the server.
mw_consent — the signed-in notice stores the analytics choice. If you are signed in, the same choice is posted to the account.
mw_access_token — token from the access-code check.
mw_session_token and mw_actor_token — copies the browser keeps so the app can call the API. The session cookie is the httpOnly copy.
mw_workspace_id — which workspace is active.

5. The two notices

Public pages show a notice that offers “Use essential cookies” and a link to this policy. Choosing essential writes mw_cookie_choice. It does not turn off mw_session, because that cookie is what keeps a later sign-in. The public notice does not load an analytics script.

Signed-in app pages can show a second notice with “Reject non-essential” and “Accept”. That notice writes mw_consent and, when the request succeeds, saves analytics and marketing flags on the account. Product events are written only when the account’s analytics flag is true. Marketing is sent as false by that notice. Public pages do not embed a third-party analytics or advertising script.

6. Email pixels are not browser cookies

Messages you send can contain an open-tracking image and rewritten links. Those are requested by the recipient’s mail client. They are not cookies in your browser. They are described in the Privacy Policy.

7. Google Fonts and optional video

Pages load Fraunces and Outfit from fonts.googleapis.com and fonts.gstatic.com. That is a request to Google. It is separate from the cookies in the table. The browser may store its own cache. Mailwright does not set a Google advertising cookie from the font stylesheet.

If an administrator attaches a YouTube or Vimeo URL, the page can embed that player (YouTube uses the youtube-nocookie host). Those players belong to their own sites and can set their own storage. They are not loaded on the legal pages unless a video URL is attached, and these drafts do not attach one.

8. How to limit storage

Use the notice buttons. You can also delete cookies and local storage in the browser. Deleting mw_session signs you out. Deleting mw_gate sends you through the access check again. Blocking all cookies will stop sign-in, because the session cookie is required.

9. Contact

Questions about this draft: support@nxtfluencez.com.