Cookie Policy

What UPSO keeps in your browser, and what you can switch off.

Version 1.0 · Effective October 9, 2026 · UPSO Technologies Inc.

UPSO sets a handful of cookies to keep you signed in, remember your language and store choices, and protect the site. One optional tool, PostHog product analytics, tells us which pages and features get used. You can turn it off on this page, and we honour your browser's Global Privacy Control signal. We show no third-party advertising and set no advertising cookies.

1. What this covers

This policy covers the UPSO websites (upso.ca and upsoapp.com) and the UPSO apps. It explains the cookies and similar browser storage we use, the services from other companies that run on our pages, and your choices. Our Privacy Policy explains how we handle personal information generally; if the two differ on personal information, the Privacy Policy applies.

A cookie is a small text record a website stores in your browser and sends back with each request. We also use local storage and session storage, which stay on your device and are not sent with requests. We call all of these "cookies" below.

2. Cookies we set

Cookie	What it does	Kind	Lasts
`upso_session`	Keeps you signed in.	Necessary	7 days
`upso_analytics`	Remembers the analytics choice you make on this page.	Necessary	1 year
`NEXT_LOCALE`	Your language, English or French.	Preference	1 year
`upso_brand_store`	The store location you picked for a brand that has several.	Preference	1 year
`upso_active_branch_id`	For store owners: the branch you are managing in the portal.	Preference	1 year

Necessary cookies make the site work and are always on: the sign-in cookie is HttpOnly and Secure, so scripts on the page cannot read it. Preference cookies remember a choice you made; without them the site still works but forgets the choice.

3. What we keep in your browser's storage

Your cart, and whether you chose delivery or pickup, so it is still there when you come back.
The location you chose and your recent locations, so listings match your area.
A referral or invite code from a link you followed, applied once when you sign up and then removed.
Small interface preferences: which panels are open, sound on or off, that you already rated an order, that you have seen the tip prompt, that you read the Caravan rules.
Sign-up progress and a crew invite code while you are creating an account (session storage, gone when you close the tab).

None of this is sent to anyone else. It stays in your browser until you clear it.

4. Services from other companies

These run on some of our pages and may set their own cookies. Each one loads only when the page needs it.

PostHog · Product analytics · optional

When: Every page, unless you switch it off below or your browser sends Global Privacy Control.

What: Which pages you open and leave and a few product events (for example that a checkout started), tied to a random browser id. Never what you type, and no session recording. It keeps a cookie named ph_…_posthog and matching local storage for 1 year. PostHog processes the data in the United States.

Stripe · Payments

When: Checkout and payment pages, and Pro identity checks.

What: Cookies __stripe_mid (1 year) and __stripe_sid (30 minutes) that help Stripe tell a real card holder from fraud. Needed to pay.

Cloudflare · Security and delivery

When: Every request to our sites passes through Cloudflare.

What: It may set __cf_bm (30 minutes) or cf_clearance to tell people from bots. Needed to protect the site.

Chatwoot · Support chat

When: Only when you open support chat.

What: A conversation token (cookie cw_conversation, up to 1 year) so your chat can continue. Hosted by UPSO at support.upso.ca.

Google Sign-In · Signing in with Google

When: When the sign-in screen opens.

What: Google's script may read and set Google's own cookies on google.com. We do not use Google's One Tap prompt.

Google Maps Platform · Address search

When: Address fields.

What: The text you type and your IP address go to Google to suggest addresses. It sets no cookie on our site.

Sentry, which receives crash and error reports, runs on our servers and inside the apps, not in your browser on the website.

5. Your choices

Checking this browser…

Global Privacy Control. If your browser or an extension sends the GPC signal, analytics stays off on this site and you do not need to do anything.
Browser settings. You can block or delete cookies in your browser. Blocking the necessary cookies signs you out and can stop checkout from working; clearing local storage empties your cart.
Where the choice lives. Your analytics choice is stored in the browser you made it in, separately for upso.ca and upsoapp.com. A new browser or device starts with analytics on.

6. The UPSO apps

The apps do not use cookies. They send crash reports to Sentry (device and app details, plus your user number, email and account type) and keep a push-notification token with Expo so notifications reach your device. They contain no analytics or advertising software. Signing in with Google or Apple in an app goes through that company's own screen.

7. Changes and contact

When we add or remove a technology, we update this page and its version number. The effective date at the top tells you which version you are reading.

Questions about cookies or your choices: [email protected].