Cookie and Local Storage Notice
Version 0.5 · 15 October 2026
Owner and qualified-counsel review copy
Source SHA-256: 78d805394b6b5ec43adacb685b3245b6f35f894ab4d4ced77fca5e288aaedc2e
VenturePath Cookie & Local Storage Notice: Owner and Counsel Review Copy
Version: 0.5 · Review date: 15 October 2026
Current early-access service
VenturePath does not intentionally install advertising or marketing trackers. The progressive web app uses a service worker and Cache Storage to retain public interface files such as pages, scripts, styles, fonts, and icons for performance and offline resilience. This cache is not used as the authoritative store for accounts or venture data.
The account service keeps the signed-in session in persistent browser storage so that an account can remain signed in after the browser closes. Signing out removes the authentication session and VenturePath business-plan data associated with signed-in accounts from that browser. The browser may otherwise retain device recovery copies until the user signs out, clears site data, or the application removes them. Cloudflare Turnstile processes browser and network information, including the visitor's IP address, to protect account and contact forms from automated abuse. Hosting, Supabase and Sentry may process limited technical and security information needed to deliver, protect and troubleshoot the service. Sentry is configured without session replay, performance tracing, user identity, request bodies or default personal information.
Optional PostHog product analytics is off unless a signed-in user turns it on from Privacy & communications in Settings. VenturePath disables PostHog automatic click/text capture, automatic page views, performance capture, exception capture, session replay, IP enrichment and browser persistence. It sends only named feature events, limited browser/device metadata and an opaque account ID; it does not send venture names, venture answers, interview content, email addresses or display names. Turning the choice off stops capture promptly and does not affect access to VenturePath.
Remembered-device verification
VenturePath verifies the first login, a new device, and a recognized device after three calendar months. Users can use a code sent to their registered email or an optional authenticator app. A verified registered mobile can be used when mobile delivery is enabled. Account confirmation, login verification and password recovery use separate codes.
The essential vp_device_<account-id> cookie stores a random credential for the account and browser profile. It is HttpOnly, Secure on HTTPS, SameSite Strict and expires three calendar months after successful verification. Page scripts cannot read it. The server stores its hash and binds recognized login sessions to that account and fixed deadline. Password login, token refresh and ordinary activity do not extend it.
Logging out removes the signed-in session and the account's local plan data, but retains this device credential until its expiry so the next login in that browser does not need another code during the three-month period. Clearing the cookie or site data requires device verification at the next login. Account deletion removes server-side device records. Plan creation and ordinary work do not add separate MFA prompts. Server-confirmed invalid or revoked sessions are refused; five incorrect email login codes end the affected login.
Production categories
| Category | Default | Purpose | Consent position |
|---|---|---|---|
| Strictly necessary authentication/security | On | Session continuity, CSRF/security, rate limiting, load balancing | Usually necessary; disclose clearly |
| Preference | Limited | Session and interface choices | Necessary operation or user choice, as applicable |
| Product analytics | Off by default | Consented feature-adoption measurement through PostHog | User-controlled opt-in; no venture answers or replay |
| Marketing/advertising | Prohibited for initial product | None | Do not deploy without a new governance and consent review |
Non-essential technology must remain blocked before choice. “Reject” must be as prominent and easy as “Accept.” Withdrawal must be available in settings, take effect promptly, and not affect essential service access. The production inventory must list name, provider, purpose, data, first/third party, duration, and access recipients.
Browser cache can be removed through browser/site-data settings or by uninstalling the web app. Optional analytics can also be withdrawn from Settings without deleting the account.