Cookies and browser storage

While you edit feature requirements, Kanten uses session storage in the current tab to keep an unsaved copy of the feature name, description, requirements and their saved baseline, scoped to your account, project and feature. Editing an existing saved case in Case repo also keeps its editable fields and baseline in tab session storage, scoped to your account, project and case. Edits to existing saved functions also keep their editable fields, questions and saved version in tab session storage, scoped to your account, project and function. Viewpoint selections, unaccepted extracted viewpoints, source-version tokens and incomplete manual viewpoint fields are also kept by account, project and feature in this tab. Recovery requires your choice and does not rerun AI. New manual function forms are also kept with a stable creation identifier so a recovered save can reuse its original request identity. New manual cases are kept by account, project and feature with their original function/viewpoint pair and creation identifier. If that pair is no longer available, automatic restoration is blocked so you can copy the draft for review. AI function review edits and selections, unsaved matrix decisions, and edited suite drafts are also kept in this tab with their original request or source-version identifiers. Restoring these reviews does not generate again or adopt them automatically. Read-only history is not included. A changed saved baseline blocks automatic restoration and lets you review and copy the draft. This supports recovery after a refresh; it does not save changes to the server or sync them to other devices. Drafts expire after seven days when accessed and are cleared when you save, discard them or sign out through Kanten. Browser tab/session restoration may preserve session storage. A random invalidation marker in local storage lets other tabs reject drafts after sign-out; this marker contains no requirement text. Browser restrictions, clearing storage or device failure can prevent recovery. Review recovered content and explicitly save it to update the project.

Supabase authentication uses cookies to maintain and refresh a signed-in session. Their names and lifetimes depend on the project and authentication configuration and they may be renewed during use. These are needed for authenticated features; blocking or deleting them may sign you out or prevent access. Hosting and security providers also process request metadata for delivery and protection as described in the Privacy notice.

On a first visit without a saved choice, Kanten uses the country inferred from the request IP to default to Japanese in Japan and English elsewhere. You can change the language at any time; your choice takes priority over location. The kanten_locale cookie remembers that choice for up to one year, and the kanten.locale local-storage entry remembers it until changed or cleared. Browser settings can remove either earlier. These entries are preferences, not advertising identifiers; the inferred country is not stored as a language preference.

The team interface can keep a recently created invitation link, invitee email and expiry information in session storage so the link can be shown again within that browser session. Treat invitation links as confidential access information. Session storage is scoped to the browser tab or session; the application checks validity, but an expiry timestamp is not a promise that stored bytes are immediately erased. Browser restoration features may retain session state. Clearing session storage removes this local copy, not the server-side invitation.

Kanten uses Vercel Web Analytics for aggregate visitor and page-view statistics on public pages, the guest demo, the viewpoint library and the sign-in/signup page. We also count fixed events for demo use, registration submissions and confirmation-email prompts; these are not proof of email verification. We exclude workspace, project, invitation and authentication-callback pages and remove query strings and fragments from the page URLs we report. We do not send account identifiers, form contents or project content as custom analytics events. Vercel processes request-derived technical information, such as browser/device information, approximate location and eligible referrers, for these statistics. Vercel describes visitor recognition as using a request-derived hash with a visitor-session lifespan of up to 24 hours, without analytics cookies; this is not a 24-hour deletion promise for aggregate reports or other service logs. We do not add advertising pixels or session replay.

You can inspect, block or clear cookies, local storage and session storage through your browser settings. This may reset your language, remove locally remembered links or end a session. Use account controls or Contact us for account, content or privacy requests. We do not treat a browser storage choice as permission for unrelated marketing or as a waiver of data-protection rights.