Cookie Policy
Last Updated: July 28, 2026
This policy explains every cookie and browser storage item that Crestline Global Partners ("CGP," "we," "us," or "our") sets on this website and in CrestlineAI, what each one is for, and how to change your mind. It sits alongside our Privacy Policy, which covers personal information more broadly.
The short version
- We use one optional, consent-requiring technology: PostHog product analytics. It does not load at all — no script, no identifier, no storage — unless you press Accept on the banner.
- Everything else we store is strictly necessary: keeping you signed in, protecting the sign-in round trip, and remembering small interface preferences. Those are exempt from consent and cannot be switched off without breaking the service.
- We do not use advertising cookies, cross-site trackers, or social-media pixels, and we do not sell or share personal information for cross-context behavioural advertising.
- Session replay — screen recording of your browsing — is disabled in both our analytics and our error monitoring, deliberately, because this site handles confidential legal documents.
Strictly necessary (no consent required)
These exist only to deliver a service you asked for — signing in, staying signed in, and remembering how you left the interface. Under the ePrivacy Directive and UK PECR they are exempt from the consent requirement.
| Name | Type | Purpose | Retention |
|---|---|---|---|
| __Host-__convexAuthJWT | Cookie (HttpOnly, Secure, SameSite=Lax) | Your CrestlineAI session token. Set when you sign in; read on every request so pages know who you are. The browser also keeps a copy in local storage — see the row below. | Short-lived, refreshed automatically. Cleared on sign-out. |
| __Host-__convexAuthRefreshToken | Cookie (HttpOnly, Secure, SameSite=Lax) | Renews the session above so you are not signed out mid-task. Also copied into local storage — see the row below. | Until you sign out or the session expires. |
| __convexAuthJWT_<deployment>, __convexAuthRefreshToken_<deployment>, __convexAuthServerStateFetchTime_<deployment> | Local storage | The sign-in library keeps its own copy of the two tokens above, plus the time it last synchronised with the server, so the interface knows who you are before the first round trip completes. We are naming these explicitly because — unlike the cookies — local storage is readable by scripts running on this site. | Cleared on sign-out, or when you clear site data. |
| __Host-__convexAuthOAuthVerifier | Cookie (HttpOnly, Secure, SameSite=Lax) | Security check for a single sign-in round trip to an identity provider — it is what stops someone else's login being swapped in for yours. | Deleted as soon as sign-in completes. |
| admin_token | Cookie (HttpOnly, Secure, SameSite=Strict) | Firm-staff session for the internal administration console. Never set for ordinary visitors. | 24 hours. |
| cgp.consent.v1 | Local storage | Records the choice you made on the cookie banner, and when. We use local storage rather than a cookie on purpose: writing you a cookie to remember that you refused cookies would be absurd, and this record never leaves your browser. | Until you change it or clear site data. |
| cgp.sidebar.collapsed | Local storage | Remembers whether you collapsed the CrestlineAI sidebar. | Until you clear site data. |
| verifyEmailDismissed:<your email> | Local storage | Remembers that you dismissed the "please verify your email" notice, so it does not reappear on every page. | Until you clear site data. |
| adminGoogleLogin | Session storage | Marks an in-progress Google sign-in for the administration console so the return trip is recognised. Staff only. | Cleared when the browser tab closes. |
Analytics (only with your consent)
We use PostHog to understand which pages and tools are actually used — page views, clicks on interface elements, and a pseudonymous identifier that ties one visit to the next. It never receives the contents of documents you upload to CrestlineAI, and we do not use it for advertising. If you sign in, we may associate analytics with your account so we can support you.
| Name | Type | Purpose | Retention |
|---|---|---|---|
| ph_<project key>_posthog | Local storage | PostHog's anonymous device and session identifiers and its event queue. Written only after you press Accept. | Until you decline, withdraw consent, or clear site data. |
| ph_<project key>_posthog, ph_<project key>_window_id, ph_<project key>_primary_window_exists | Session storage | PostHog also keeps a copy of the above scoped to this browser tab, plus the identifiers that let it tell one tab from another. Written only after you press Accept. | Cleared when the tab closes, or when you decline or withdraw consent. |
| ph_* (legacy cookies) | Cookie | Earlier versions of this site let PostHog fall back to its default cookie storage. We now pin it to local storage, and we actively delete any leftover ph_ cookie on this domain when consent is declined or withdrawn. | Deleted on decline or withdrawal. |
| __ph_opt_in_out_<project key> | Local storage | PostHog's own record that this browser opted out. It is written only if you decline after previously accepting, and it is what keeps the library silent — so we deliberately do not delete it during cleanup. | Until you accept again or clear site data. |
PostHog is a processor acting on our instructions; it retains the events it receives under its own retention schedule. Session replay is explicitly disabled.
Error monitoring (no cookies)
We use Sentry to be told when something breaks. It sets no cookies and no browser storage, so it is not a matter for this policy's consent banner; it runs on the legitimate interest of keeping a service that handles legal work reliable and secure. It samples a small fraction of requests for performance timing, and — like PostHog — session replay is switched off so that privileged document content can never be uploaded with an error report. If you object to this processing, contact us using the address below.
Third parties that load only when you ask
Nothing below runs on page load. Each is fetched in response to a specific action you take, and each may set its own cookies under its own policy once it does:
- Google Identity Services and Google Picker: loaded only when you choose to import a document from Google Drive.
- Google Fonts:requested only for the live font preview on the CrestlineAI onboarding screen and on our internal demo pages. The site's own typefaces are self-hosted and contact nobody.
- Stripe:checkout is a full-page redirect to Stripe's own domain — we do not run Stripe's scripts on our pages. Any cookies set during checkout are Stripe's, governed by Stripe's privacy policy.
Changing or withdrawing your choice
Use the button below, Cookie preferences in the footer of any page on the main site, or Cookie preferences at the bottom of the CrestlineAI sidebar. The banner reopens with both options available, and withdrawing is as easy as granting: choosing Decline immediately stops analytics capture, clears the PostHog identifiers from local and session storage, and deletes any ph_ cookie already on this domain. Withdrawing consent does not affect the lawfulness of anything processed before you withdrew it.
Clearing cookies and storage yourself
You can remove everything this site has stored from your browser settings — in Chrome and Edge, Settings → Privacy and security → Third-party cookies → See all site data and permissions; in Safari, Settings → Privacy → Manage Website Data; in Firefox, Settings → Privacy & Security → Cookies and Site Data → Manage Data. Most browsers also let you block cookies for a site outright, though doing so will sign you out of CrestlineAI and keep you from signing back in. Note that clearing site data also erases the record of your cookie choice, so the banner will ask again on your next visit.
Changes to this policy
If we add anything that requires consent, we will update this page and ask again rather than reading an old answer as agreement to something new.
Contact Us
Questions about this policy, or a request to exercise your rights, can go to privacy@cgp-legal.com.