Cookie Policy

1. Overview

VibeCheck uses cookies and similar browser storage for service operation, presentation, authentication, abuse resistance, and—only when you choose—optional public-site analytics. This policy explains what the current product stores, what is necessary for the service, and how optional Analytics differs from necessary storage.

This Cookie Policy works alongside the Privacy Policy, Terms of Service, and Security & Data Architecture page. Personal-data handling beyond cookies and similar storage is described in the Privacy Policy.

VibeCheck keeps several mechanisms separate and does not merge them into one generic consent system: necessary service storage; the anonymous Analytics preference stored in the browser; authenticated consent_records used for signed-in privacy purposes; Vercel Web Analytics; and Google Analytics 4.

2. What Cookies and Similar Storage Are

• Cookies: small pieces of data stored by the browser for a site, which may be readable by the browser and, depending on attributes, by the server.
• localStorage: browser storage that persists across sessions until cleared, used by VibeCheck for the anonymous Analytics preference record.
• sessionStorage: browser storage limited to a browsing session/tab, used for short-lived UX markers such as Magic Link send state, Vault return context, and a marketing signup funnel flag.

Provider technologies (for example authentication, CAPTCHA/anti-bot, or analytics scripts) may set their own cookies or use other storage according to the provider. Exact provider cookie names and lifetimes can change and are not fully controlled by VibeCheck.

3. Necessary Cookies and Storage

Necessary cookies and similar storage support core service functions such as presentation, authentication session continuity, and selected abuse/security signals. They are not an optional Analytics choice. The product can set or rely on necessary storage even when Analytics is undecided or rejected.

• vc_theme: first-party cookie for presentation/theme preference (light, obsidian, or system). Path=/; Max-Age approximately 365 days; SameSite=Lax; Secure when the site is served over HTTPS; not HttpOnly (readable by client presentation code).
• vc_install: first-party HttpOnly cookie used as an installation identifier for privacy-preserving abuse/security signals on applicable free-plan/scan paths. Path=/; Max-Age approximately 400 days; SameSite=Lax; Secure in production. The application hashes related network signals rather than treating raw IP as sole identity for free-plan abuse scoring.
• Supabase Auth session cookies: necessary authentication/session cookies managed by the Supabase Auth integration. Exact cookie names and attributes are provider-driven and may vary; VibeCheck does not invent or hard-code those names in this policy.
• vc.login.magic-link-sent: sessionStorage key used for Magic Link send/resend UX and cooldown state in the same browser tab. Necessary authentication UX; not Analytics consent.
• vibecheck.vault.returnDocumentId: sessionStorage key used to restore Vault return navigation after certain billing flows. Necessary product UX; not Analytics consent.

4. Analytics Preference

Optional public Analytics is controlled by a first-party browser preference stored in localStorage under the key vc_analytics_preference. This preference is not a tracking cookie created by VibeCheck, and it is not the same system as authenticated consent_records stored for signed-in users.

• States: undecided; analytics_granted; analytics_denied.
• Versioned record: the stored JSON includes a consent version (currently aligned with product consent versioning), purpose product_analytics, state, and updatedAt.
• Event: when the preference changes, the application may dispatch a browser event named vc:analytics-preference so client components can react.
• Undecided: optional Analytics remains off. The Cookie Consent banner may appear.
• Accept Analytics: persists analytics_granted and enables optional public analytics loaders/emission where otherwise configured.
• Reject Analytics: persists analytics_denied and keeps optional Analytics off.

Returning visitors with a resolved preference (granted or denied) do not normally see the banner again until the stored preference is cleared, becomes invalid, or the stored version/purpose no longer matches.

5. Authentication Fallback and Analytics Preference

If a visitor has not selected an Analytics preference and initiates authentication (for example Login / Send Link), the current implementation establishes a necessary-only Analytics preference by persisting analytics_denied so optional Analytics remains off while authentication can proceed.

That fallback is not Analytics acceptance. Login, Magic Link request, or Google Sign-In does not equal Accept Analytics. If a visitor already has analytics_granted or analytics_denied stored, the fallback does not overwrite that resolved preference.

6. Vercel Web Analytics

When Vercel Web Analytics is enabled in the deployment configuration and the visitor has analytics_granted, VibeCheck may load the Vercel Analytics client for public marketing measurement. Emission is also gated to approved public paths; authenticated workspace and tool routes are not part of the public analytics allowlist.

The current VibeCheck code describes this integration as cookieless public marketing analytics in the product sense that VibeCheck does not create a dedicated first-party analytics cookie for it. Cookieless does not mean that no data is collected. The provider may process technical or request-derived signals such as URL/path, referrer, device type, browser, operating system, and geolocation-related information according to the provider's service behavior.

VibeCheck does not treat those signals as a legal determination of anonymity. Query strings are stripped from analytics URLs in the application filter where applied. Auto pageviews from the provider component are suppressed in favor of explicit public page_view events designed by VibeCheck.

7. Google Analytics 4

When a Google Analytics 4 Measurement ID is configured and the visitor has explicitly accepted Analytics (analytics_granted), VibeCheck may load Google's gtag.js on approved public marketing and legal pages only.

• Load gate: GA4 is not initialized while preference is undecided or analytics_denied, when no Measurement ID is configured, or when the current route is not an approved public path.
• Excluded routes: /login and authenticated workspace/tool routes are not approved public analytics paths and are not intended to receive GA pageviews or GA events from this implementation.
• Allowed GA events from the application mapper: page_view, cta_clicked, and pricing_interacted, using allowlisted parameters only (for example page_path / public_path and cta or pricing identifiers).
• Not intentionally mapped to GA: contract, invoice, estimate, or other document contents; document IDs or names; financial amounts; email addresses; phone numbers; postal addresses; or arbitrary URL query strings.
• Provider cookies: after GA loads, Google may set cookies such as _ga and _ga_* according to Google's documentation and configuration. Lifetimes and exact cookie behavior are provider-controlled; VibeCheck does not claim a VibeCheck-fixed expiry for those cookies.

GA4 involves processing by Google. VibeCheck does not claim that GA4 is absolutely anonymous, that IP addresses are always anonymized as a legal guarantee, or that Google retains no data.

8. Authentication and Security Technologies

• Supabase Auth: necessary session/authentication cookies and related auth processing as described above.
• Cloudflare Turnstile: used as a security / anti-abuse challenge on login flows, with server-side token verification. Turnstile is not optional Analytics. Provider-set cookies or storage, if any, follow Cloudflare's behavior; this policy does not invent exact Turnstile cookie names or durations.
• vc_install and hashed network signals: used for abuse resistance on applicable paths, as described under Necessary Cookies and Storage.

9. Session Storage Used by VibeCheck

• vc_marketing_signup: sessionStorage marketing signup funnel marker used to correlate a short-lived public signup-completion analytics signal when Analytics is granted. Cleared after use where implemented. Analytics-related, not a durable server identity record.
• vc.login.magic-link-sent: Magic Link UX/cooldown state (necessary authentication UX).
• vibecheck.vault.returnDocumentId: Vault return navigation helper (necessary product UX).

10. How to Change Your Analytics Choice

Accept Analytics and Reject Analytics are offered in the Cookie Consent banner when preference is undecided. Those choices persist in localStorage under vc_analytics_preference.

The current product does not provide a separate signed-in settings screen dedicated to changing this anonymous Analytics preference. If you previously accepted or rejected Analytics and want to choose again, clear the vc_analytics_preference entry (or clear site data for tryvibecheck.in / the site origin you use) in your browser. After the preference becomes undecided or invalid, the Cookie Consent banner can appear again on a subsequent visit.

You may also use browser controls to block or delete cookies and site storage. Blocking necessary cookies may prevent sign-in, theme persistence, or other core functions.

11. Third-Party Provider Technologies

Depending on configuration and your choices, third parties that may set or read cookies or process related technical data include:

• Supabase — authentication and application infrastructure.
• Cloudflare — Turnstile anti-abuse challenges.
• Vercel — hosting and, when enabled and consented, Web Analytics.
• Google — Google Analytics 4 when enabled and consented; Google Sign-In when you choose that authentication method.

Providers may process information outside India. VibeCheck does not promise that all cookie or analytics-related processing occurs only in India. Provider roles, cross-border mechanisms, and legal bases are described at a product level here and in the Privacy Policy; detailed legal classification may require separate legal review.

12. Retention and Expiry

• vc_theme: approximately 365-day Max-Age unless cleared earlier.
• vc_install: approximately 400-day Max-Age unless cleared earlier.
• vc_analytics_preference: persists in localStorage until cleared, overwritten, or invalidated by version/purpose mismatch.
• sessionStorage keys: end when the browsing session/tab ends or when the application removes them.
• Supabase Auth cookies and Google Analytics cookies: governed by the relevant provider; VibeCheck does not publish a fixed VibeCheck-controlled retention period for those provider cookies in this policy.

Where public web analytics is enabled, VibeCheck does not define a fixed retention period in this Cookie Policy for provider-controlled analytics records; those records may be retained according to the provider's applicable terms and practices.

13. Authenticated Consent Records

Signed-in privacy consent records (consent_records) are a separate authenticated-server mechanism from the anonymous vc_analytics_preference localStorage record. Accepting or rejecting Analytics in the public Cookie Consent banner does not by itself create or replace authenticated consent_records. Details of privacy rights and authenticated consent purposes appear in the Privacy Policy.

14. Changes to This Cookie Policy

VibeCheck may update this Cookie Policy when the product's cookies, similar storage, or analytics implementation changes. The version and last-updated values at the top of this page identify the current text. Material changes to categories of optional tracking will be reflected in an updated notice.

15. Contact

Questions about this Cookie Policy: team@tryvibecheck.in. Operator: Mehta Industries. Product: VibeCheck. Website: https://tryvibecheck.in.

For broader personal-data questions, see the Privacy Policy. For security architecture, see the Security page.