# VenturePath Cookie & Local Storage Notice: Owner and Counsel Review Copy

**Version:** 0.4 · **Review date:** 30 September 2026

## Current early-access service

VenturePath does not intentionally install advertising or marketing trackers. The progressive web app uses a service worker and Cache Storage to retain public interface files such as pages, scripts, styles, fonts, and icons for performance and offline resilience. This cache is not used as the authoritative store for accounts or venture data.

The account service keeps the signed-in session in persistent browser storage so that an account can remain signed in after the browser closes. Signing out removes the authentication session and VenturePath business-plan data associated with signed-in accounts from that browser. The browser may otherwise retain device recovery copies until the user signs out, clears site data, or the application removes them. Cloudflare Turnstile processes browser and network information, including the visitor's IP address, to protect account and contact forms from automated abuse. Hosting, Supabase and Sentry may process limited technical and security information needed to deliver, protect and troubleshoot the service. Sentry is configured without session replay, performance tracing, user identity, request bodies or default personal information.

Optional PostHog product analytics is off unless a signed-in user turns it on from **Privacy & communications** in Settings. VenturePath disables PostHog automatic click/text capture, automatic page views, performance capture, exception capture, session replay, IP enrichment and browser persistence. It sends only named feature events, limited browser/device metadata and an opaque account ID; it does not send venture names, venture answers, interview content, email addresses or display names. Turning the choice off stops capture promptly and does not affect access to VenturePath.

## Production categories

| Category | Default | Purpose | Consent position |
|---|---|---|---|
| Strictly necessary authentication/security | On | Session continuity, CSRF/security, rate limiting, load balancing | Usually necessary; disclose clearly |
| Preference | Limited | Session and interface choices | Necessary operation or user choice, as applicable |
| Product analytics | Off by default | Consented feature-adoption measurement through PostHog | User-controlled opt-in; no venture answers or replay |
| Marketing/advertising | Prohibited for initial product | None | Do not deploy without a new governance and consent review |

Non-essential technology must remain blocked before choice. “Reject” must be as prominent and easy as “Accept.” Withdrawal must be available in settings, take effect promptly, and not affect essential service access. The production inventory must list name, provider, purpose, data, first/third party, duration, and access recipients.

Browser cache can be removed through browser/site-data settings or by uninstalling the web app. Optional analytics can also be withdrawn from Settings without deleting the account.