Cookie Policy

Totem uses storage that is necessary to sign you in, protect forms and sessions, remember the active workspace, and resume a workflow you deliberately started. These functions cannot be switched off through the analytics control because the hosted service may not work without them.

Google Analytics is optional. Totem does not load its script or send it a page-view before you select “Allow.” Selecting “Deny” leaves analytics off. A supported Global Privacy Control or Do Not Track signal also selects essential-only storage when no Totem choice has already been saved.

Use “Manage cookie choices” in the footer to change your selection. Clearing browser storage also clears the saved choice, so Totem will ask again.

• NextAuth session, CSRF, and callback cookies: authenticate signed-in requests, prevent cross-site request forgery, and return you to an allowed Totem page. Session lifetime depends on the cookie and whether you remain signed in.
• totem.organizationId: stores the active organization identifier for up to 30 days. It is HttpOnly, SameSite=Lax, Secure in production, and sent only over the encrypted HTTPS connection in production.
• totem_cookie_consent: records “accepted” or “declined” for up to one year so the site can honor the analytics choice. It does not contain an account ID or advertising profile.

Totem uses limited first-party browser storage for the following product functions:

• a contact-invitation token, intended email, and expiration in session storage so an invitation can resume after sign-in;
• temporary onboarding progress in session storage; and
• a one-way account-and-workspace marker in local storage indicating that the sandbox demo was completed.

Session storage normally disappears when the browser tab or session ends. The sandbox completion marker remains until browser storage is cleared. Totem removes expired or invalid invitation data when detected and does not use these values for advertising.

If analytics is configured and you accept it, Google Analytics may set identifiers such as _ga and _ga_* to distinguish browsers and measure public-site visits. Totem disables advertising storage, Google signals, and ad personalization in its configuration and limits the configured analytics-cookie lifetime to 13 months.

Analytics is not required to create an account, book a demo, or use Totem. Totem does not currently use advertising pixels, cross-site behavioral advertising cookies, or session-replay tracking. The Google Calendar booking frame is loaded only after you choose to open the demo-booking flow and is governed by Google’s own terms and notice.

The Privacy Policy explains broader data practices. Email privacy@totemlayer.com with a cookie or privacy question. Do not send passwords, API keys, payment-card details, or invitation tokens.