Cookies Policy

Application

We (Tenderly D.O.O. and Tenderly Technologies Inc. — referred to collectively as "Tenderly") use "cookies" and other tracking technologies to collect and disclose information about you and your activity across our website (tenderly.co, the "Website") and our web application (dashboard.tenderly.co, the "Dashboard") to help us improve your online experience in connection with Tenderly.

Policy

Tenderly believes in transparency about the collection and use of data. This policy provides information about how and when Tenderly uses cookies for these purposes. Capitalized terms used in this policy but not defined have the meaning set forth in our Privacy Policy, which also includes additional details about the collection and use of information at Tenderly.

What is a cookie?

Cookies are small text files placed on your computer or mobile device that enable Tenderly's features and functionality. They are unique to your account or your browser. Session-based cookies last only while your browser is open and are automatically deleted when you close it. Persistent cookies last until you or your browser delete them or until they expire. Because the Dashboard is a web application, we also store some working state in your browser's local and session storage; we treat that storage the same way as cookies for the purposes of this policy.

Does Tenderly use cookies?

Yes. Tenderly uses cookies and similar technologies, including browser storage, both session-based and persistent, on the domains it operates (collectively, the "Sites"). Tenderly also uses third-party cookies and services: on the Website, Google (Analytics, Ads), Cloudflare (Turnstile), Matomo, FullStory, Ahrefs, LinkedIn, X, Reddit, Apollo.io, G2 and lemlist; on the Dashboard, Google (Analytics, Tag Manager), Cloudflare (Turnstile), Matomo, FullStory, Ahrefs, ActiveCampaign, Stripe and WorkOS. The Website and the Dashboard share the parent domain .tenderly.co, so a cookie set by one may be visible on the other; each cookie is governed by the property that set it and by the choice you made there.

How is Tenderly using cookies?

Some cookies are associated with your account to remember that you are logged in and which organization you are working in. Other cookies are not tied to your account but are unique and allow us to carry out analytics and to remember your preferences, among other things. We group our use into the categories below.

Authentication: If you are signed in to the Dashboard, cookies help Tenderly show you the right information and keep your session active. Sign-in is handled on our behalf by WorkOS.
Security: Tenderly uses cookies and services such as Cloudflare Turnstile and Stripe to enable security features, prevent fraud on payment forms, and detect malicious or automated activity. Turnstile runs only when you submit a protected form and, in our checks, set no cookie or browser storage; an interactive challenge may set a cookie on Cloudflare's own domain. On the Website, a region cookie lets the consent banner apply the right default.
Preferences, features, and services: On the Dashboard, browser storage records the choices you make and the work you leave unfinished — your theme, sidebar and table layout, saved filters, recent searches, notices you closed and partially completed forms — so the Dashboard behaves consistently and unfinished work survives navigation. This storage exists only because of an action you took, is never transmitted, and is strictly necessary to provide what you asked for.
Performance, Analytics, and Research: With your consent, cookies and tools such as Google Analytics, Matomo, FullStory and Ahrefs help Tenderly learn how the Website and the Dashboard perform and how they are used, so we can improve them. FullStory records how you interact with the interface (session replay). These are set only after you opt in.
Marketing: On the Website, with your consent, advertising platforms (Google Ads, LinkedIn, X, Reddit) measure our campaigns and may use your visit to show you relevant ads on their platforms, and Apollo.io, G2 and lemlist identify business visitors. On the Dashboard, one marketing-automation tool (ActiveCampaign) identifies visitors with your consent; the Dashboard does not serve or measure advertising, and its advertising, ad-personalisation and ad-user-data signals are set to "denied" in all cases.

What third-party cookies does Tenderly use?

You can find the third-party cookies Tenderly uses, along with other relevant information, in the cookie tables in Appendix A (Website) and Appendix B (Dashboard). Tenderly does its best to keep these tables updated, but please note that the number and names of cookies, pixels, and similar technologies may change from time to time.

How are cookies used for advertising purposes?

On the Website, if you allow the Marketing category, third parties such as Google, LinkedIn, X and Reddit may use the fact that you visited tenderly.co to show you ads about our services on their platforms and to measure our campaigns. Their use of tracking is governed by their own privacy policies. You can prevent this by leaving the Marketing category off, and you may opt out of interest-based advertising through the Network Advertising Initiative or the Digital Advertising Alliance. The Dashboard does not use cookies, beacons, pixels, or tags to serve interest-based advertising, and Tenderly does not sell personal data.

Optional cookies are off until you opt in, and you can disable or delete them at any time. On the Website, use the "Cookie preferences" button on tenderly.co/cookies (Necessary, Analytics, Marketing; if you visit from the EU, EEA, United Kingdom or Switzerland, Analytics defaults to off). On the Dashboard, use Account → Security → Cookie Settings or, while signed out, the Tenderly menu at the top left of the page (Strictly Necessary, Functional, Analytics, Marketing; every optional category is off by default in every region). You can also use your browser settings. Blocking categories may impact your experience. Withdrawing consent deletes the cookies of that category and stops the associated tools; on the Dashboard, withdrawing Marketing reloads the page so the tool stops, and a Functional counter stored before this choice existed is kept until you decline the Functional category.

Does Tenderly respond to Do Not Track signals?

Tenderly does not change its behaviour on receipt of a "Do Not Track" signal. Browsers' Global Privacy Control signal needs no special handling on our Sites: analytics and marketing tools stay off in every region until you opt in, and you can withdraw at any time through the consent tools above.

Appendix A: Website Cookie Tables (tenderly.co)

Necessary

Required for the Website to work and to remember your consent choices. Always active. Cloudflare Turnstile protects some of our forms against automated abuse and sets no cookie.

Cookie	Provider	Duration	Type
tnd-region	Tenderly	24 hours	First party — coarse region (EU or rest of world) for the banner default.
tnd-cookie-prefs	Tenderly	Until deleted	First party, local storage — your per-category preferences.
tnd-cookie-consent	Tenderly	Until deleted	First party, local storage — legacy consent choice.

Analytics

Set only if you allow the Analytics category. Ahrefs Web Analytics also runs after the opt-in; it sets no cookie. Matomo's heatmap and session-recording plugin is enabled.

Cookie	Provider	Duration	Type
_ga, _ga_3MG9H4NR7Y	Google Analytics	400 days	Third party — distinguishes visitors and sessions.
_pk_id.*	Matomo	392 days	Third party — pseudonymous visitor identifier (tenderly.co only).
_pk_ses.*	Matomo	30 minutes	Third party — groups requests into one visit.
fs_uid	FullStory	1 year	Third party — session-replay visitor identifier (also kept in local storage as _fs_uid).
fs_lua	FullStory	30 minutes	Third party — last activity (also kept in local storage as _fs_lua).

Marketing

Set only if you allow the Marketing category. LinkedIn conversion tracking runs only when you submit a demo request. lemlist visitor tracking runs with this category and sets no cookie of its own. Advertising platforms may additionally set cookies on their own domains, governed by their own policies.

Cookie	Provider	Duration	Type
_gcl_au, __gcl_au	Google Ads	3 months	Third party — conversion attribution (a copy is kept in local storage as _gcl_ls).
_rdt_uuid	Reddit	3 months	Third party — Reddit Ads attribution.
_twpid, _twsid	X	13 months	Third party — X (Twitter) Ads visitor and session identifiers.
tdly_attr_first, tdly_attr_last	Tenderly (via Google Tag Manager)	365 days / 90 days	First party, on .tenderly.co — first- and last-touch campaign attribution; set only when a campaign source, referrer or click id is detected.
apolloAnonId	Apollo.io	Until deleted	Third party, local storage — B2B visitor identification (plus _canTrack and _eventQueue keys).
g2tracking	G2	Until deleted	Third party, local storage — buyer-intent identification.

Other Website providers that receive data

Provider	Purpose	Region
Vercel	Hosting and content delivery; sets the tnd-region cookie from your IP address.	United States / global edge
Salesforce	Receives contact and demo-request form submissions, including the attribution data above.	United States
Cloudflare (Turnstile)	Bot and abuse detection on protected forms; runs only when such a form is submitted.	Global edge network (EU and US)
lemlist	Website visitor tracking for sales outreach (Marketing category).	European Union (France)
YouTube (Google)	Embedded videos on some pages; YouTube sets its own cookies when a video is played.	United States

Appendix B: Dashboard Cookie Tables (dashboard.tenderly.co)

Strictly Necessary Cookies

These cookies are necessary for the Dashboard to function and cannot be switched off in our systems. They are usually set only in response to actions you take, such as setting your privacy preferences, logging in, or opening a payment form. You can set your browser to block or alert you about these cookies, but parts of the Dashboard will then not work. Cloudflare Turnstile protects some of our forms against automated abuse and sets no cookie.

Cookie	Provider	Duration	Type
cookie-consent	Tenderly	6 months	First party — stores your cookie choices.
workos-has-session	WorkOS	400 days	First party — records that a signed-in session exists.
__stripe_mid	Stripe	1 year	Third party — payment fraud prevention (on card forms).
__stripe_sid	Stripe	30 minutes	Third party — payment fraud prevention (on card forms).
m	Stripe	Up to 400 days	Third party — payment fraud prevention (m.stripe.com).

Performance / Analytics Cookies

These cookies let us count visits and traffic sources so we can measure and improve the Dashboard, understand how visitors move around it, and replay interface sessions to diagnose problems. They are set only after you opt in, and are deleted if you withdraw consent. Ahrefs Web Analytics also runs after the opt-in; it sets no cookie. To view an overview of Google Analytics privacy, see support.google.com/analytics/answer/6004245. You may install the Google Analytics opt-out add-on at tools.google.com/dlpage/gaoptout.

Cookie	Provider	Duration	Type
_ga	Google Analytics	400 days	Third party — distinguishes visitors.
_ga_X4KV3LPMTK	Google Analytics	400 days	Third party — maintains session state.
_pk_id.4.*	Matomo	392 days	Third party — distinguishes visitors.
_pk_ses.4.*	Matomo	30 minutes	Third party — groups requests into one visit.
_pk_ref.4.*	Matomo	6 months	Third party — records the referring site.
mtm_cookie_consent	Matomo Tag Manager	400 days	Third party — record of the analytics opt-in.
fs_uid	FullStory	1 year	Third party — identifies the session-recording visitor (also mirrored in local storage as _fs_uid; both are cleared when you withdraw).
fs_lua	FullStory	30 minutes	Third party — last activity in a recording session (also mirrored in local storage as _fs_lua; both are cleared when you withdraw).

Marketing Cookies

The Dashboard does not use cookies to serve advertising. We use one marketing-automation tool that sets a cookie to identify visitors. It is set only if you allow the Marketing category, is deleted if you withdraw, and the page reloads on withdrawal so the tool stops. No advertising or ad-personalisation signals are enabled.

Browser Storage

The Dashboard stores some working state in your browser rather than in cookies. None of this storage is analytics, none is shared with any third party, and none leaves your device. Strictly necessary storage exists only because of an action you took. Local storage persists until you clear your site data, except that signing out removes the sign-in target, the project you were working in, your saved transaction and transfer filters and your recent searches; session storage is cleared when you close the tab.

Category	Keys	What is stored
Strictly necessary — sign-in	5 + session storage	Sign-in redirect target, sign-in flow and source, the project you were working in, your answer to a one-time feature prompt; in session storage, a pending action to resume after sign-in, an invitation credential held for up to 30 minutes, and WorkOS sign-in helpers removed when sign-in completes.
Strictly necessary — flow flags	3	Single-use flags that finish an action you started before a redirect.
Strictly necessary — layout & display	18	Theme, sidebar state, table columns and ordering, sort order, panel width, developer mode.
Strictly necessary — filters & recall	12 + one per project	Saved filters, recent searches, favourite and recent projects and requests, selected explorer and network, networks last used per project.
Strictly necessary — dismissed notices	10	Records that a banner, announcement or disclaimer has been dismissed.
Strictly necessary — work in progress	6	Partially built alert rules, a display setting for the Virtual TestNet wallet view, and the wallet addresses and test network sessions used in simulations.
Strictly necessary — tool settings	3	Settings for the built-in RPC client, the last-used contract read/write tab, a cache of token search results.
Functional — usage counter	1	Counts how often you have used the RPC request builder, to stop showing its hint. Never transmitted.

Pages that offer wallet connection load the WalletConnect and Coinbase Wallet SDKs only after you choose a wallet. Choosing WalletConnect also starts Reown AppKit, which reports the page address to WalletConnect's telemetry, fetches wallet listings and contacts the relay once a wallet pairs. Both SDKs keep connection state in browser storage, including WalletConnect's IndexedDB database; it is removed when you disconnect.

Other providers that receive data (not consent-gated)

The following providers are necessary to run, secure, and support the service and are not analytics. They rely on our performance of the contract with you or our legitimate interest in operating and improving a secure service.

Provider	Purpose	Region
Sentry	Error reports (stack traces, page addresses, pseudonymous ID; no name or email) and one anonymous session record per page load, used to see which release is in use and whether it crashes. Contacts Sentry on every page load.	United States
Pylon	Support chat — name, email and conversation content; loads only when you open support. Keeps your chat language and a connection setting in browser storage. Conversations are deleted within 30 days of a deletion request; transfers rest on the EU Standard Contractual Clauses in Pylon's data processing agreement.	United States
Stripe	Payments, billing and payment fraud prevention.	United States
WorkOS	Authentication and account data.	United States
Cloudflare (Turnstile)	Bot and abuse detection on protected forms; runs only when such a form is submitted.	Global edge network (EU and US)
WalletConnect (Reown), Coinbase Wallet SDK	Wallet connection, only after you choose a wallet; WalletConnect's telemetry and relay then receive the page address.	Provider-operated, global

How to Control and Delete Cookies

1. Using the consent tools. Optional cookies are off until you opt in, and you can change or withdraw your choice at any time: on the Website from the "Cookie preferences" button on tenderly.co/cookies, on the Dashboard from Account → Security → Cookie Settings or, while signed out, from the Tenderly menu at the top left.

2. Using your browser. Most cookies can be disabled through your browser settings, usually under the "Help", "Tools" or "Privacy" menus. Disabling a cookie does not delete it from your browser unless you do so manually.

3. Cookies set in the past. If you withdraw consent, we stop using the disabled cookies to collect further information. On the Dashboard, the cookies of the withdrawn category are deleted; on the Website, cookies already set may remain until they expire and can be deleted through your browser. Information collected before your change may already have been processed.

Changes and contacts

Changes to our Cookies Policy

This Cookie Policy can be changed from time to time. If we change anything important about this Cookie Policy, we will notify you through a pop-up on the Website or the Dashboard in a reasonable time period prior to and following the change.

Contact Information

You can contact us by email at support@tenderly.co.