Cookie Policy
Which cookies and browser storage SemPost uses in its app, its Shopify app and its websites, why, for how long, and how you can control them.
Version and validity
- Version and effective date: 30 October 2026
- Last updated: 30 October 2026
- Issued by: CS Digital Wonders LLC ("CS Digital Wonders", "we", "us"), a limited liability company organized under the laws of the State of Wyoming, USA, which operates SemPost. Address: 30 N Gould St Ste N, Sheridan, WY 82801, USA.
- How we announce changes: when we add, remove or change a cookie or a browser storage item, we update this page and list the change in the "Changes" section at the end. If we ever want to use cookies that need your consent, we will ask for it first (section 11).
- Languages: this policy is published in English (/legal/cookies) and in Turkish (/tr/legal/cookies) with the same content. If the two differ, the Turkish version prevails for people who live or are established in Turkey and the English version for everyone else, as in our Terms of Service.
1. What cookies and similar technologies are
- A cookie is a small text file that a website stores in your browser and reads back later.
- A first-party cookie is set for the address you visit (for example app.sempost.ai). A third-party cookie is set for another address.
- A session cookie is deleted when you close your browser. A persistent cookie stays until it expires or you delete it.
- Similar technologies include browser storage: localStorage keeps data until it is deleted; sessionStorage keeps data until the browser tab is closed.
- Cookies can contain personal data or be linked to it, for example a cookie that keeps you signed in. Our Privacy Policy and KVKK Information Notice explain how we process personal data.
2. Summary
- The SemPost app uses cookies only to keep you signed in, to protect your actions against forged requests, and to remember three display preferences: language, time zone and the sidebar.
- We use no advertising, analytics, tracking or social media cookies.
- The Shopify app inside Shopify admin sets no SemPost cookies.
- Our website and its help center set no cookies of their own; they keep only your theme choice in your browser. Visits are counted with Cloudflare Web Analytics, which does not use cookies.
- Cloudflare, which protects our sites, sets two security cookies (section 8).
- We do not show a cookie banner, because we use only cookies that the service needs (section 11).
3. Where this policy applies
- app.sempost.ai: the SemPost app (section 4).
- admin.sempost.ai: the administration site that only our staff use (section 5).
- embed.sempost.ai: the SemPost Shopify app inside Shopify admin (section 6).
- www.sempost.ai and docs.sempost.ai: our website and its help center at www.sempost.ai/docs, which docs.sempost.ai leads to (section 10).
4. Cookies on app.sempost.ai
All cookies in this table are first-party cookies for app.sempost.ai. Our own cookies are read by our servers in the United States.
| Name | Set by | Purpose | Category | Lifetime | Details |
|---|---|---|---|---|---|
__Host-sp_s | SemPost | Keeps you signed in. It holds a random session token; we store only a one-way (SHA-256) hash of it. | Strictly necessary | Up to 30 days; the session ends earlier after 7 days without use | HttpOnly (scripts cannot read it), Secure, SameSite=Lax, for the whole site |
__Host-sp_csrf | SemPost | Protects your actions against cross-site request forgery: a signed value that the app sends back with each change | Strictly necessary | Same as the session cookie | Secure, SameSite=Lax; the app's own scripts read it |
sp_locale | SemPost | Remembers the interface language, so pages appear in your language from the first moment. When you are signed in, it follows the language saved in your account. | Preferences | 1 year | SameSite=Lax; marked Secure when the app sets it in your browser, not when our server first sets it on a new device |
sp_tz | SemPost | Remembers your browser's time zone, so dates and times are shown in your local time | Preferences | 1 year | SameSite=Lax; Secure on https |
sp_sidebar | SemPost | Remembers whether the sidebar is open or closed | Preferences | 7 days | SameSite=Lax; not marked Secure |
Cloudflare also sets the security cookies in section 8.
5. Cookies on admin.sempost.ai (our staff only)
| Name | Set by | Purpose | Category | Lifetime | Details |
|---|---|---|---|---|---|
__Host-sp_as | SemPost | Keeps a staff member signed in to the administration site | Strictly necessary | Until the browser is closed; the server ends the session after 30 minutes without use and after 12 hours at most | HttpOnly, Secure, SameSite=Lax |
__Host-sp_acsrf | SemPost | Protects administrative actions against cross-site request forgery | Strictly necessary | Until the browser is closed | Secure, SameSite=Lax |
sp_locale | SemPost | Remembers the interface language | Preferences | 1 year | SameSite=Lax |
The administration site also uses one sessionStorage item, sp_admin_login, during sign-in (section 7).
6. The Shopify app (embed.sempost.ai)
- SemPost sets no cookies on embed.sempost.ai. Each request from the app carries a short-lived ID token that Shopify gives to the app.
- The addresses of images and videos carry a key (
mt) that is tied to your session and stops working when the session ends. - The app loads Shopify's App Bridge script from cdn.shopify.com. Shopify admin itself uses Shopify's own cookies under Shopify's policies.
- Some of the browser storage items in section 7 can also be used by the app inside Shopify admin, if your browser allows storage in embedded pages.
7. Browser storage
The app and our website keep these items in your browser. They are not sent to our servers automatically; the pages read them in your browser.
| Key | Type | Where | Purpose | How long |
|---|---|---|---|---|
theme | localStorage | App, website and help center | Light or dark theme | Until it is deleted |
sempost:generate: followed by the workspace ID | localStorage | App | Your last choices in the Generate form for that workspace | Until it is deleted |
sempost:generate:hidden | localStorage | App | Which finished generation jobs you closed, so they stay hidden in this browser | Until it is deleted; finished jobs leave the list after a day anyway |
sempost:calendar-zone: followed by the workspace ID | localStorage | App | Whether the calendar shows the workspace's time zone or your device's | Until it is deleted |
sempost:video:guide-hidden | localStorage | App | Whether you hid the guide in Video Studio | Until it is deleted |
sp-connect-attempt | localStorage | App | A social account connection you started but did not finish (the network and the time), so the page can offer to try again | Used for 30 minutes; kept until it is replaced or deleted |
sp_admin_login | sessionStorage | Administration site | During a staff sign-in: the temporary token for the second sign-in step and, while two-factor authentication is being set up, the authenticator secret and its setup address | Until the browser tab is closed |
8. Cloudflare security cookies
Cloudflare protects all our sites and sets these strictly necessary security cookies on our addresses:
| Name | Set by | Purpose | Category | Lifetime |
|---|---|---|---|---|
__cf_bm | Cloudflare | Bot management: helps tell people from automated traffic (bots) | Strictly necessary | Up to 30 minutes |
cf_clearance | Cloudflare | Set only when you pass a security challenge, so that the challenge is not shown again | Strictly necessary | As long as our Cloudflare settings let a passed challenge count |
These cookies are set on our own addresses (first party), but Cloudflare sets and reads them. Cloudflare's location and the transfer safeguard are on our Sub-processors page. Cloudflare describes these cookies as strictly necessary. Cloudflare Turnstile, the bot check on our sign-up and sign-in forms, does not set cookies, according to Cloudflare; it sends a check token and your IP address to Cloudflare.
9. Other third parties
- Stripe (Link): the checkout page and the customer portal run on Stripe's own pages. Stripe and Link use their own cookies there under their own policies. The app does not load Stripe's scripts.
- Social networks and Zernio: when you connect a social account, you go to the network's page and to the pages of our social gateway Zernio. Their own cookies apply there.
- Images from other servers: the app loads some images, such as post thumbnails and profile pictures, from the servers of social networks, our social gateway and stores. We ask your browser not to tell these servers which page you are on, but they receive your IP address and browser information, as with any image. We do not control what they do.
- Fonts: our fonts are served from our own servers; your browser does not contact a font service.
- The app has no analytics, tag manager, advertising, error-tracking or chat scripts, and no embedded frames from other sites.
10. Our websites: www.sempost.ai and docs.sempost.ai
- The sites have no sign-in, set no cookies of their own and have no forms that ask for personal data. You contact us by email.
- The sites keep one item in your browser:
theme, your choice of a light or dark theme, in local storage (section 7). They store nothing else. - We count visits with Cloudflare Web Analytics. It does not use cookies. It loads a small script from Cloudflare.
- Cloudflare's security cookies (section 8) also apply to these sites.
- We do not plan to use cookies that are not necessary. If we do, we will ask for your consent first and update this policy.
11. Why we do not show a cookie banner
- In the European Union (ePrivacy Directive Article 5(3)), in the United Kingdom (Privacy and Electronic Communications Regulations) and under the Turkish Personal Data Protection Authority's cookie guide, consent is not needed for cookies that are strictly necessary to provide a service you have asked for. Our session and request-forgery protection cookies, and Cloudflare's security cookies, are such cookies.
- The three preference cookies (
sp_locale,sp_tz,sp_sidebar) only remember choices you make, or your browser's time zone, so that the service appears the way you asked for. We treat them as needed for the service you requested. - Even though we do not ask for consent, we must tell you which cookies we use. This page does that.
- If we ever use cookies that need consent, we will ask before setting them: with "Accept", "Reject" and "Preferences" choices of equal weight, nothing pre-selected, the service available whatever you choose, a record of your choice, and an easy way to change your mind later.
12. How to control cookies and browser storage
- You can see, block and delete cookies and site data in your browser's settings. Your browser's help pages explain how. A private window deletes them when you close it.
- If you block strictly necessary cookies, you cannot sign in to the app or use it securely.
- If you delete the preference cookies, the app uses its default settings until you choose again. When you are signed in, the app sets the language cookie again from the language saved in your account; you can change that language in your profile.
- To delete browser storage, clear the site data for app.sempost.ai or www.sempost.ai in your browser.
- If you block Cloudflare's security cookies, you may see security checks more often, or may not be able to reach our sites.
13. Personal data, legal basis and transfers
- The session cookie is linked to your account, so it is personal data. Our Privacy Policy explains how we process it.
- Legal basis: for strictly necessary cookies, the performance of our contract with you (GDPR Art. 6(1)(b); KVKK m.5/2-c) and our legitimate interest in protecting the service (GDPR Art. 6(1)(f); KVKK m.5/2-f); for preference cookies, the performance of the contract.
- Cloudflare's security cookies are set by Cloudflare, a provider located outside Turkey. Under the Turkish Personal Data Protection Authority's cookie guide, cookies of a foreign provider involve a transfer of personal data abroad. Transfers are explained in our Privacy Policy (section 15) and our KVKK Information Notice (section 7).
14. Contact
Questions about cookies: [email protected].
Changes
| Date | Change |
|---|---|
| 30 October 2026 | First published |