Cookie Policy

Last updated: 2026-10-22

This Cookie Policy explains how Shambix uses cookies and similar technologies for the Patcherly service (a brand of Shambix).

What we use

Below is a practical list of cookies and similar technologies we or our providers may set when you use the public website (patcherly.com), the dashboard (app.patcherly.com), or related sign-in flows. Exact names can vary by browser, consent choices, and whether you are logged in.

Public website (marketing and legal pages)

Consent (Cookiebot): CookieConsent on patcherly.com - stores your cookie choices; loaded via Cookiebot (consent.cookiebot.com).
Analytics (Google Analytics 4): _ga and related cookies on .patcherly.com - on the public marketing website only, with consent as configured in Cookiebot. The dashboard at app.patcherly.com does not load Cookiebot or marketing analytics cookies.
Product analytics (HeyCatch): loads only after you accept the Statistics category in Cookiebot, on the public marketing website only. It measures how visitors use marketing pages (for example which sections are read). It does not run on app.patcherly.com.
Security / CDN (Cloudflare): cf_clearance on .patcherly.com - bot management / security; may be HTTP-only and Secure.
Support chat (Intercom): intercom-id-*, intercom-session-* and related cookies on .patcherly.com - on the public marketing website only, and only after you accept the Preferences category in Cookiebot. They keep your chat conversation attached to you between page loads. Decline and the chat widget is never loaded.

Dashboard sign-in

When you sign in (email/password, Sign in with Google, or Sign in with GitHub), the dashboard uses cookie-based sessions shared across our .patcherly.com domains so the app can authenticate you securely:

patcherly_access_token - HTTP-only short-lived session credential.
patcherly_refresh_token - HTTP-only credential used to renew your session.
patcherly_csrf - anti-forgery token used with authenticated requests.
patcherly_auth - non-secret indicator so the dashboard knows a session may be present (not a substitute for server-side authentication).
patcherly_mfa_handoff - short-lived HTTP-only cookie used when multi-factor authentication is required after social login or other sign-in paths that defer MFA to the dashboard MFA page.

Sign in with Google or GitHub also involves cookies and sessions on Google or GitHub domains during the provider’s own authentication pages; those are controlled by the provider, not by Patcherly. After a successful social login, Patcherly stores only a linked provider identity as described in the Privacy Policy - not the provider’s access token.

Hosted MCP (AI assistants)

Connecting an IDE or assistant to hosted MCP uses Patcherly-issued OAuth tokens (Bearer access tokens), not cookies on the marketing site. Consent and token management happen in the dashboard (for example Profile → MCP). Session cookies for the dashboard consent page follow the dashboard sign-in list above.

Third-party and embedded resources

Google: Loading Google Analytics, fonts, or other Google assets may set additional cookies on Google domains (e.g. __Secure-ENID on .google.com) according to Google’s policies.
Stripe: When you use billing, checkout, or the Stripe customer portal, Stripe may set its own cookies on Stripe domains - see Stripe’s cookie policy.
CDNs and media: We use third-party CDNs (e.g. jsDelivr for libraries, Google Fonts for typography). Those requests normally do not set first-party Patcherly cookies; embedded images or widgets from other sites may cause those third-party domains to set their own technical cookies.

Local storage and session storage

Beyond cookies, the dashboard may use localStorage (e.g. preferences and UI column visibility) and sessionStorage (short-lived UI state). The documentation site may use a separate auth cookie (patcherly_docs_auth).

Managing preferences

Use Manage privacy preferences in the site footer (under Legal), or your browser settings, to review or change cookie choices. Blocking all cookies may affect login and functionality.

Contact

Shambix, Via Tornabuoni 4, 50125 Firenze, Italy. [email protected] or [email protected].