The short version. We run no advertising cookies, no analytics cookies, and no third-party trackers. There is no Google Analytics, no Meta pixel, no session-recording tool. We set exactly one cookie, and it exists to survive a redirect during sign-in. Because everything we set is strictly necessary to make the Service work, we do not show a cookie consent banner.
1. Cookies we set
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
v_oauth_screen |
Remembers which screen you were on so we can return you there after the Google sign-in redirect. | Strictly necessary, first-party | 10 minutes |
Our authentication provider, Supabase, also maintains your signed-in session. Depending on your browser this uses cookies or browser storage. It is strictly necessary — without it you would be signed out on every page load.
2. Browser storage we use
Most of what we keep in your browser is not a cookie at all. It is localStorage and
sessionStorage, which stay on your device and are never transmitted automatically
with requests.
| Key | Store | Purpose |
|---|---|---|
v_token | localStorage | Your session token, so you stay signed in |
v_username | localStorage | The email on your account |
v_tenant | localStorage | The brand you last had open |
v_plan | localStorage | Your current plan, to render entitlements without a round trip |
v_oauth_restore, v_checkout_restore | localStorage | Restores what you were doing after returning from Google sign-in or Stripe checkout |
aria_session | sessionStorage | Keeps your onboarding chat continuous within a tab |
v_funnel_session | sessionStorage | A random identifier that lets us see where sign-up gets stuck. Not linked to any advertising profile |
v_reg_mode, v_billing_intent, v_invite_free_plan | sessionStorage | Short-lived sign-up and checkout state |
Clearing site data in your browser removes all of these. Doing so signs you out; nothing else breaks permanently.
3. Analytics
We measure sign-up funnel drop-off using our own first-party endpoint. Those events record a random session identifier, the step reached, and — once you are identified — the email on your account. They are stored in our own database and are not shared with any advertising or analytics network. This is covered in the Privacy Policy.
4. Third-party requests
Our marketing site loads the Inter typeface from Google Fonts. Requesting a font file discloses your IP address and user agent to Google, and is governed by Google's privacy policy. Google Fonts does not set cookies for this. It is the only third-party request our marketing pages make.
Inside the application, additional third-party connections are made to services that are part of delivering the product — our authentication provider, payment provider, and media storage. These are listed at /legal/subprocessors/.
Pages you publish through the Service are hosted by the social platform you publish to, and any cookies set when someone views them are that platform's, not ours.
5. Controlling this
Every browser lets you block or delete cookies and clear site storage. Blocking the items above will prevent you from signing in, because they are the mechanism by which sign-in works. There is nothing here to opt out of for advertising purposes, because we do not do any.
We honour Global Privacy Control and Do Not Track signals by default, in the sense that we already do not perform the tracking those signals ask us to stop.
6. Changes
If we ever add analytics or advertising technology, we will update this notice, add a consent mechanism before setting anything non-essential, and increment the version. This notice is version 1.0. Questions: contact@hanuxai.com.