# VenturePath Cookie & Local Storage Notice: Owner and Counsel Review Copy

**Version:** 0.3 · **Review date:** 16 August 2026

## Current early-access service

VenturePath does not intentionally install advertising or marketing trackers. The progressive web app uses a service worker and Cache Storage to retain public interface files such as pages, scripts, styles, fonts, and icons for performance and offline resilience. This cache is not used as the authoritative store for accounts or venture data.

The account service uses temporary browser session storage for the signed-in session. Closing the browser session or signing out removes that device session. Hosting, Supabase and Sentry may process limited technical and security information needed to deliver, protect and troubleshoot the service. Sentry is configured without session replay, performance tracing, user identity, request bodies or default personal information.

Optional PostHog product analytics is off unless a signed-in user turns it on from **Privacy & communications** in Settings. VenturePath disables PostHog automatic click/text capture, automatic page views, performance capture, exception capture, session replay, IP enrichment and browser persistence. It sends only named feature events, limited browser/device metadata and an opaque account ID; it does not send venture names, venture answers, interview content, email addresses or display names. Turning the choice off stops capture promptly and does not affect access to VenturePath.

## Production categories

| Category | Default | Purpose | Consent position |
|---|---|---|---|
| Strictly necessary authentication/security | On | Session continuity, CSRF/security, rate limiting, load balancing | Usually necessary; disclose clearly |
| Preference | Limited | Session and interface choices | Necessary operation or user choice, as applicable |
| Product analytics | Off by default | Consented feature-adoption measurement through PostHog | User-controlled opt-in; no venture answers or replay |
| Marketing/advertising | Prohibited for initial product | None | Do not deploy without a new governance and consent review |

Non-essential technology must remain blocked before choice. “Reject” must be as prominent and easy as “Accept.” Withdrawal must be available in settings, take effect promptly, and not affect essential service access. The production inventory must list name, provider, purpose, data, first/third party, duration, and access recipients.

Browser cache can be removed through browser/site-data settings or by uninstalling the web app. Optional analytics can also be withdrawn from Settings without deleting the account.