1. What This Policy Covers
This policy covers cookies, local storage, session storage, SDK identifiers, pixels, tags, and similar browser technologies used by GuidMe websites and the web app.
2. Consent Categories
- Necessary: authentication, security, fraud prevention, session management, consent records, rate limiting, and service delivery. These cannot be switched off inside GuidMe.
- Functional: preferences, feature flags, optional personalization, and client-side experimentation where enabled.
- Analytics: product analytics, browser telemetry, performance monitoring, and usage measurement where enabled.
- Marketing: marketing attribution or advertising technologies if introduced. No third-party advertising or retargeting pixels were found in the reviewed code.
3. Tools Observed in the Codebase
Necessary or operational services include Supabase authentication/session storage, Cloudflare Turnstile for bot protection, Stripe for payment flows, and server-side operational telemetry.
Consent-gated analytics or functional tools include Amplitude, browser OpenTelemetry, GrowthBook client-side SDK, and related script loading through GuidMe consent state. Referly referral scripts are marketing tools and must remain marketing-gated. Sentry error tracking is configured with PII redaction; session replay should remain off unless separately consent-gated.
4. Current Browser Storage Inventory
- Supabase auth cookies (Supabase / GuidMe) - necessary: Keeps signed-in users authenticated and protects private routes. Storage: First-party HttpOnly cookies. Duration: Session lifetime managed by Supabase; cleared on sign-out.
- guidme_consent / guidme_cookie_consent (GuidMe) - necessary: Stores versioned cookie/privacy preferences or a shared reset marker. Storage: Local storage and a necessary first-party cookie shared across GuidMe sibling hosts. Duration: Preference state until expiry; reset marker up to one year or until re-consent.
- guidme_consent_session_id (GuidMe) - necessary: Links anonymous consent evidence to a browser session without storing email. Storage: Session storage. Duration: Browser session.
- guidme-language (GuidMe) - functional: Remembers language preference for public pages and app UI. Storage: Local storage and first-party locale cookie. Duration: Until changed or cleared.
- Cloudflare Turnstile (Cloudflare) - necessary: Bot and abuse prevention on public forms. Storage: Cookie or browser storage set by Cloudflare where required. Duration: Managed by Cloudflare.
- Amplitude (Amplitude) - analytics: Product analytics where analytics consent is granted. Storage: Browser storage / SDK identifiers. Duration: Managed by SDK configuration and consent state.
- GrowthBook (GrowthBook) - functional: Feature flagging and experiments where enabled. Storage: Browser storage / SDK identifiers. Duration: Managed by SDK configuration and consent state.
- Userback (Userback) - functional: Feedback widget where functional consent is granted. Storage: Browser storage / widget cookies. Duration: Managed by Userback and consent state.
- Referly (Referly) - marketing: Referral attribution and referral widget identity where marketing consent is granted. Storage: Browser storage / widget identifiers. Duration: Managed by Referly and consent state.
5. Managing Preferences
First-time visitors see a cookie banner. Users can accept all, reject non-essential categories, or customize choices. A cookie icon lets users reopen preferences after a choice is saved. Consent is versioned and may be refreshed when the policy changes.
GuidMe honours Global Privacy Control or browser Do Not Track signals by suppressing analytics, marketing, and email-marketing consent in client state. Necessary cookies and storage still run where needed to provide the service.
6. Email Marketing and Email Tracking
Newsletter/email marketing consent is separate from cookie marketing consent. Service, security, legal, billing, and transactional notices are not marketing and may be sent regardless of marketing opt-in status where lawful.
Marketing email open and click tracking, and one-to-one email tracking pixels or tracked links, should remain disabled unless the recipient has given legally sufficient consent for that tracking in the relevant jurisdiction. Transactional security links should not use tracking that rewrites or weakens token links.
7. Changes
If GuidMe adds non-essential tracking, advertising pixels, session replay, or materially different analytics, the consent manager, Privacy Notice, Cookie Policy, and vendor register should be updated before those technologies load.