Cookie Policy

This Cookie Policy explains how SchemaForce, LLC (“SchemaForce,” “we,” “us”) uses cookies and similar technologies on our website and web application. It should be read together with our Privacy Policy, which describes how we handle personal information more generally.

This policy concerns information collected through your browser as you use SchemaForce. It does not concern the Salesforce metadata SchemaForce processes on your instructions, which is governed by our Privacy Policy and Data Processing Addendum.

Cookies are small text files that a website stores in your browser. They let a site recognize your browser, keep you signed in, remember preferences, and understand how the site is used.

We also use closely related technologies, including browser local storage and session storage, which store small amounts of data in your browser for similar purposes. In this policy, references to “cookies” include these related technologies unless stated otherwise. We use them sparingly and only for the purposes described below. We do not use tracking pixels or beacons for advertising.

Essential. These are required for the application to function. They keep you authenticated, maintain your session, protect against fraud and abuse, and remember basic preferences such as light or dark theme. Some essential cookies are set by us; others are set by the security and infrastructure providers we rely on to deliver the service (see Section 5). Because the product does not work correctly without them, essential cookies cannot be disabled through SchemaForce, though you can still clear them in your browser, which will sign you out. We rely on these on the basis of our legitimate interest in providing a secure, working service and, where applicable law treats it as such, because they are strictly necessary to provide a service you have requested.

Analytics. We use a limited set of product analytics, provided by PostHog, to understand which features are used and where people get stuck, so we can improve SchemaForce. This data concerns how the product is used; it does not include the contents of your Salesforce records. We load analytics only after you accept cookies (see Section 6); if you decline, no analytics cookies are set. We do not use advertising, marketing, or cross-site tracking cookies.

Essential cookies maintain your authenticated session (set by us and by Supabase, our authentication and hosting provider), support single sign-on where you use it (WorkOS), and protect the billing and checkout flow against fraud (Stripe, set only when you reach checkout). A small amount of data such as your light/dark theme preference is kept in your browser’s local storage.

Analytics cookies, set by PostHog, record product usage so we can improve the service.

Cookie names and durations are determined by us and by these providers and may change as the providers update their services; you can always inspect and clear the exact cookies set on your device through your browser’s developer tools.

Delivering a secure, working application means relying on a small number of infrastructure and security providers, some of which set their own essential cookies when you use SchemaForce: Supabase (authentication and hosting), WorkOS (authentication and single sign-on), and Stripe (billing and fraud prevention during checkout). PostHog sets the analytics cookie described above. The providers that may set cookies correspond to the sub-processors listed on our Security page.

These providers act on our behalf to provide the service and are bound by contractual data-protection obligations. We do not permit them to use cookies set through SchemaForce for their own advertising.

Browser controls. You can clear or block cookies through your browser settings. Blocking essential cookies may sign you out or break parts of the application. Blocking analytics cookies has no effect on functionality.

Cookie banner. When you first visit, a banner lets you accept or decline non-essential (analytics) cookies. We do not load analytics until you accept; if you decline, no analytics cookies are set. You can revisit the choice by clearing cookies in your browser, which brings the banner back. Our analytics is limited to product usage and is never used for advertising.

California privacy. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the California Consumer Privacy Act as amended (“CCPA/CPRA”). Because we do not sell or share in this sense, there is no such activity to opt out of. California residents have additional rights — to know, delete, correct, and limit certain uses — described in our Privacy Policy.

Visitors in the EU, UK, and similar jurisdictions. SchemaForce is operated from the United States. Where applicable law requires consent before non-essential cookies (including analytics) are set, we obtain that consent through the cookie banner before setting them, and you may withdraw it at any time by declining in the banner or clearing your cookies.

We may update this Cookie Policy from time to time to reflect changes in the technologies we use or in applicable law. We will update the “Last updated” date above and, for material changes, provide a more prominent notice.

Questions about this policy can be sent through our contact page, or to privacy@schemaforce.com.