BriefCapsule · Legal
Cookie Information
Current browser storage and tracking information, with consent controls still pending a later implementation stage.
1. Current consent status
A consent-management platform (CMP) and a visitor preference interface are not yet implemented. This document is information only: reading it, scrolling or continuing to use the site is not an explicit cookie-consent choice.
Google Tag Manager currently loads Google Analytics before a consent choice is available. Where prior consent is required, non-essential analytics must be blocked until valid consent can be obtained. That gating and the later CMP remain outstanding work; publishing this draft does not implement them.
2. Authentication and protected access
Supabase authentication cookies maintain account sessions when you sign in. Their names follow the sb-…-auth-token family and can be split into multiple cookies. Browser cookie lifetime and server session validity are separate; final session settings and the inventory will be confirmed before approval.
After a correct password is supplied for a protected Capsule, the service can set a bc_access_… cookie containing a signed access proof. The browser lifetime is configured as one hour. It is HttpOnly, uses SameSite=Lax and is Secure in production; it does not contain the plain-text password.
3. Functional browser draft storage
The text-creation form uses sessionStorage for draft values and submission retry information. This storage is scoped to the browser tab/session and can contain the Capsule text and recipient details entered into the form. Browser session-restore behavior can affect how long it remains available.
Clearing that storage does not delete an already submitted Capsule from the service. The functional classification and final retention wording will be reviewed with the final cookie policy.
4. Google Analytics cookies
The current website review observed _ga and _ga_BZ4GEQ8BGS cookies, together with a request to Google Analytics, in a fresh anonymous browser before any interaction. These are website analytics, not authentication or protected-Capsule access cookies.
Analytics cookies support visitor and session measurement. Their effective expiry depends on tag configuration and browser limits; the reviewed Chrome browser showed a lifetime of approximately 400 days. The approved tag inventory, purposes and durations still need final confirmation.
5. The Home reflection identifier
The three-question experience uses a new random identifier held in memory for each page load. The feature does not add a cookie, localStorage entry, fingerprint or persistent identifier. Its server-side event records are described in the Privacy Policy.
Existing website analytics is a separate data path. The absence of a reflection cookie does not mean that the rest of the website is free of analytics cookies.
6. Controls and work still to complete
Your browser can show, block or clear cookies and storage. Blocking authentication or access cookies may prevent sign-in or password-protected access from working. These browser controls are separate from the consent-management interface planned for the website.
Before non-essential tags are treated as consent-based, the site needs default blocking, clear accept and reject choices, category preferences, stored choices and a way to withdraw consent. The legal basis, jurisdictions and final processor details also require review.
Still to finalize
- Block non-essential tracking where prior consent is required until consent controls exist
- Approve the full GTM tag inventory and cookie purposes/durations
- Implement and verify CMP accept, reject, preferences and withdrawal
- Review functional draft-storage classification
- Confirm jurisdictions, providers and final cookie wording