Cookie policy · Obelisk

Effective: November 6, 2026

This policy lists every cookie and every piece of browser storage that Obelisk uses, on our own websites and in the tracking script our customers can add to theirs. It is part of our privacy policy. "Obelisk", "we" and "us" mean The Obelisk App Inc.

The short version

Our marketing site, theobelisk.app, sets no cookies of its own and runs no analytics.
The Obelisk app, app.theobelisk.app, uses only cookies and storage it needs to sign you in, keep you secure and remember your display settings.
We don't use advertising cookies, analytics cookies or cross-site tracking on our own sites, so we don't show a cookie banner there.
The Obelisk tracking script on our customers' websites stores nothing in a visitor's browser until that visitor accepts analytics cookies.

Cookies in the Obelisk app

All of these are first-party (set by app.theobelisk.app) and strictly necessary. They're set only when you do something that needs them, such as signing in, starting a free audit or connecting Google.

Name	What it does	How long
`__Secure-obelisk.session_token`	Keeps you signed in.	7 days, renewed each day you use Obelisk
`__Secure-obelisk.state`	Protects Google sign-in from forged requests.	5 minutes
`__Secure-obelisk.better-auth-passkey`	Holds the one-time challenge while you sign in or register with a passkey.	5 minutes
`__Secure-obelisk.two_factor`	Holds your sign-in for the second step while you enter a code from your authenticator app or a backup code. Only set if you turned on two-step verification.	10 minutes
`__Secure-obelisk.trust_device`	Remembers that you chose to trust this device, so it doesn't ask for a two-step code each time you sign in. Only set if you tick "Don't ask again on this device".	30 days, renewed each time you sign in with it
`better-auth.last_used_login_method`	Remembers how you signed in last time (for example Google or a passkey) so the sign-in page can suggest it. It holds no personal data.	30 days
`__Host-mini-owner`	Lets the browser that started a free audit claim it after signing up.	Until you close the browser
`__Host-google-attempt`	Ties a Google Search Console or Google Analytics connection to the browser that started it, so nobody else can complete it.	Until you close the browser

Cookies marked __Secure- or __Host- are sent only over encrypted connections. All except better-auth.last_used_login_method are hidden from page scripts.

Other storage in the Obelisk app

The app keeps a few settings in your browser's local storage or session storage. None of it is sent to us or used to track you.

Key	What it does	How long
`obelisk.shell.theme`	Light, dark or system theme.	Until you clear it
`obelisk.shell.collapsed`	Whether the sidebar is open or collapsed.	Until you clear it
`obelisk.shell.recent`	Pages you opened recently, for quick navigation.	Until you clear it
`obelisk.table-density`	How tightly tables are spaced.	Until you clear it
`better-auth.message`	Keeps sign-in in step across your open tabs.	Replaced with each sign-in event
`obelisk.edges.stale-reload`	Lets a tab reload itself once after we release a new version.	Until you close the tab

Our error monitoring (Sentry) doesn't set cookies, doesn't record your screen and doesn't collect cookies from your browser.

Our marketing site

theobelisk.app sets no cookies and uses no analytics, advertising or tracking scripts.

Bot checks. When you send the contact form or start a free audit, Cloudflare Turnstile runs a short check in a Cloudflare frame to tell people from bots. Cloudflare reads signals from your browser to do this and processes them under its own Turnstile privacy addendum. We don't use Turnstile's pre-clearance cookie. The app uses the same check on sign-in and a few other forms.
Free audits. The free-audit form sends you to the app, which sets __Host-mini-owner as described above.
Content editors. People at Obelisk who preview unpublished pages get an obelisk_cms_preview cookie that lasts as long as their preview link. Visitors never get it.

Third-party pages

Payments. Checkout and the billing portal open on Stripe's own pages. Stripe sets its own cookies there to process payments and prevent fraud, under Stripe's cookie policy.
Google sign-in. Signing in with Google, or connecting Search Console or Google Analytics, takes you to Google's pages, where Google's own cookies apply.

Obelisk tracking on our customers' websites

Our customers can add the Obelisk tracking script to their own websites. On those websites the customer decides how the script is used and is responsible for asking visitors' consent. Obelisk processes the data for them. The cookies below are first-party to the customer's website, not to Obelisk.

Name	Type	What it does	How long	When
`_obk_id`	Cookie	A random visitor ID that links one person's visits to that website.	390 days	Only after the visitor accepts analytics cookies. Deleted when they withdraw consent.
`cc_cookie`	Cookie	Remembers the visitor's cookie choice, so the banner doesn't ask again on every page. Only used when the website uses Obelisk's built-in banner.	182 days	When the visitor makes a choice
`_obk`	Link parameter	Carries the visitor ID across the business's own websites so they recognise the same visit. It is removed from the address bar as soon as the page loads.	Valid for 2 minutes	Only after consent
`_ga`	Google's cookie, read only	If the website also uses Google Analytics, the script reads the Google Analytics client ID so the business can match its Google Analytics data to visits. Obelisk never sets or changes it.	Set by Google	Read only after consent

Before a visitor chooses, the script writes nothing to the browser: no cookies, no local storage, no session storage. It counts the visit without cookies, as our privacy policy explains.

Google Consent Mode. When a website uses Obelisk's banner together with Google tags, the banner passes the visitor's choice to Google using Google Consent Mode v2. Analytics maps to analytics_storage. Marketing maps to ad_storage, ad_user_data and ad_personalization. All four start as "denied" until the visitor chooses.

IAB framework. Obelisk's banner doesn't use the IAB Transparency and Consent Framework. Websites that need it for advertising partners should use a registered consent platform and pass the visitor's choice to Obelisk through it.

Your choices

You can block or delete cookies in your browser settings. If you block the app's cookies, you won't be able to sign in.
On a website that uses Obelisk tracking, you can change your mind at any time through that website's cookie banner or settings. Withdrawing consent deletes _obk_id.

Changes and contact

We update this policy whenever we add, remove or change a cookie. The date at the top shows the latest version. Questions: privacy@theobelisk.app.

Cookie policy.