Cookie and Similar Technologies Policy

1. Overview

This policy explains how Vizuna uses cookies and similar technologies (including localStorage and sessionStorage in your browser) on our marketing website, customer portal, and admin portal.

We use these technologies for a limited set of purposes: to keep you signed in, to remember short-lived UI state, to measure aggregate site usage, and to operate first-party product analytics that help us improve Vizuna. We do not use third-party advertising cookies, ad-measurement pixels, or cross-site tracking.

2. What we mean by "cookies and similar technologies"

• Cookies are small text files that a website stores on your device through your browser. They can be session cookies (deleted when you close the browser) or persistent cookies (kept for a defined lifetime).
• Browser storage includes localStorage (persistent, tied to the origin and cleared when you clear site data) and sessionStorage (scoped to a single browser tab and discarded when the tab closes). We treat browser storage as a "similar technology" because it can perform some of the same functions as cookies.
• Pixels, beacons, and SDKs are scripts or image tags that can record information when a page loads. Vizuna does not use third-party advertising pixels. We do operate our own first-party telemetry script, described below.

3. Categories of technology we use

We group the technologies we set on your browser into four categories. Categories marked strictly necessary are required to deliver the Service you explicitly request; other categories are optional and subject to the opt-out controls in Section 6.

3.1 Strictly necessary (always on)

• Authentication session cookies (set by Supabase Auth) — keep you signed in to the customer and admin portals. Lifetime: session / refresh window.
• Security cookies (for example, CSRF and session-protection cookies) — protect against cross-site request forgery and session hijacking. Lifetime: session.
• Auth return-path cookie (for example, vizuna_auth_return_path) — remembers the URL you were trying to reach before being asked to sign in. Lifetime: a few minutes.

Disabling these will break sign-in and core portal features.

3.2 Functional (short-lived UI state)

• localStorage UI preferences — theme, layout, and similar preferences. Lifetime: until you clear site data.
• sessionStorage flow state — carries signup / onboarding flow state between steps. Lifetime: until you close the tab.
• vizuna_tracking_optout — localStorage flag used to record that you have opted out of first-party product analytics. Lifetime: until you clear site data.

3.3 Aggregate site analytics (marketing site only)

• Plausible Analytics — aggregate page views, referral sources, browser type, and country-level location for our public marketing site. No cookies, no cross-site tracking, no personal data. See Plausible's data policy.
• Vercel Speed Insights — core web-vitals and page-load timing for site performance monitoring. No cookies, no personal content.

3.4 First-party product analytics (Vizuna behavior telemetry)

We operate a first-party product analytics pipeline that runs across the marketing site and customer portal. Internal /admin pages are intentionally excluded from this dataset. Unlike a third-party analytics SDK, this pipeline runs on our own code and stores events on our own infrastructure (Supabase); no advertising network or data broker receives this data.

Items stored on your browser:

• vizuna_visitor_id (localStorage) — long-lived pseudonymous browser ID so we can distinguish new vs. returning visitors on our own site. Not linked to your Vizuna account, email, or any advertising network. Regenerated every 12 months, or cleared sooner when you clear site data or opt out.
• vizuna_visitor_id_issued_at (localStorage) — timestamp used to enforce the 12-month rotation on vizuna_visitor_id.
• vizuna_anon_id (sessionStorage) — legacy random pseudonymous ID used to correlate events within a single browser tab. Retained only while the 90-day event log rolls over. Cleared when you close the browser tab.
• vizuna_session_id (sessionStorage) — random session ID used to reconstruct page-view paths during the same session. Rotates after 30 minutes of inactivity; cleared when you close the browser tab.
• vizuna_session_last_active (sessionStorage) — timestamp used to enforce the 30-minute idle rotation on vizuna_session_id.
• vizuna_session_referrer_captured (sessionStorage) — marker recording that we already captured the referring URL / UTM parameters for this session, so we do not re-capture them on every page view.
• vizuna_tracking_optout (localStorage) — opt-out flag; when set to true the tracker does not run and vizuna_visitor_id is cleared. Kept until you clear site data.

What events are collected when you have not opted out: page paths, the browser-level descriptor of elements you click (for example, button.cta-primary), approximate click coordinates, maximum scroll depth, viewport dimensions, and session duration.

What is deliberately not collected: your name, email, password, reflection text, VizunaAI chat content, IP address, user-agent string, precise geolocation, or any third-party advertising identifier. Events are not joined to your authenticated user_id.

Retention: up to 90 days on a rolling basis, then automatically deleted.

Legal basis: legitimate interests in understanding product usage and fixing issues. Where the ePrivacy Directive, PECR, or equivalent local rules treat storage of non-essential information on your device as requiring consent, the opt-out control described in Section 6 is how you express or withdraw that preference.

4. Advertising cookies

Vizuna does not set third-party advertising cookies or tracking pixels and does not share data with advertising networks for retargeting.

5. Outreach tracking

Vizuna does not currently set a dedicated outreach-attribution cookie on your browser. Our internal business development team may record server-side that a tracked outreach link was clicked (see the Privacy Policy for details), but this reporting flow does not install a browser-side cookie or tag.

6. How to control and opt out

We offer two ways to turn off first-party product analytics. Both take effect immediately — the tracker is stopped in the current tab as soon as the toggle is flipped, with no page reload required.

• In the site footer — Cookie preferences (everyone): every public Vizuna page has a Cookie preferences link in the footer legal rail. Clicking it opens a modal with an Anonymous product analytics toggle. Switching it off writes the vizuna_tracking_optout flag to localStorage for the current browser. This works whether or not you are signed in.
• In your account — Manage tracking (signed in): if you are signed in as a Vizuna user, go to /me/account and use the Manage tracking card. Flipping that toggle both (a) writes the vizuna_tracking_optout flag to localStorage in your current browser, and (b) persists your preference to your Vizuna user profile (profile_summary.preferences.tracking_optout), so the next time you sign in from a different device or browser we reapply the same choice.
• Advanced / scripted users: you can set localStorage key vizuna_tracking_optout to the string true directly. You can also contact support@vizuna.com if you want our team to record your opt-out on your behalf.
• Functional storage: you can clear localStorage and sessionStorage for our domain using your browser's site-data controls.
• Cookies: you can control cookies through your browser settings. Disabling strictly-necessary cookies will break sign-in and core portal features.
• Do Not Track / Global Privacy Control: we do not currently rely on browser-level DNT or GPC signals because industry support is inconsistent; we instead offer the opt-out controls above. This may evolve as standards settle.

7. Changes

We may update this policy as our use of cookies and similar technologies changes. The "Last Updated" date at the top of the document reflects the most recent change.

8. Contact

If you have questions about this policy, contact us at support@vizuna.com.