1. What Are Cookies?

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work efficiently and to provide information to site operators. We also use similar technologies including local storage, session storage, and SDKs in our mobile experiences — for simplicity, we refer to all of these as "cookies" in this policy.

2. Cookies We Use

Strictly necessary cookies

These cookies are essential for the platform to function and cannot be switched off. They are usually set in response to actions you take, such as logging in, filling forms, or setting your privacy preferences.

Authentication cookies (Supabase): sb-*-auth-token — keep you signed in across pages. HTTP-only, Secure, SameSite=Lax. Lifetime: session + 7 days refresh.
CSRF / Origin cookies: set by our middleware to verify requests originate from our domain. Cleared on logout.
Cookie consent preference (allwise_cookie_consent): remembers your choice in our consent banner. Lifetime: 12 months.

Performance & error monitoring

We use third-party services to monitor platform performance and catch errors. These tools collect technical information (IP address, browser type, page URL, error stack traces) necessary to diagnose issues. This data may incidentally include user-supplied input.

Sentry (error monitoring): see Sentry's privacy policy. Data sent: error stack traces, IP, user agent.
Vercel Analytics (page performance): see Vercel's privacy policy. Data sent: page load times, IP, user agent, country.

Fonts and external assets

Google Fonts: loaded from Google's CDN. Data sent: IP, user agent, referrer. Google may set cookies for analytics. See Google's privacy policy.
Stripe (payment forms only): Stripe sets cookies to prevent fraud and remember payment preferences. See Stripe's privacy policy.

Marketing & conversion tracking (loaded only with your consent)

The following tracker is loaded only after you click Accept in the cookie consent banner. Choosing Essential only blocks it entirely. No personal information (email, name, address) is ever sent to these services — only aggregated conversion events.

Meta Pixel (Facebook conversion tracking): Meta sets cookies to measure ad performance and build aggregated audience reports. See Meta's privacy policy. Data sent: page URL, referrer, IP, user agent, browser type. Loaded from connect.facebook.net only after consent. Revoke consent at any time via the Cookies Policy link in the site footer.

3. Cookies We Do NOT Use

We do not sell personal information to advertising networks. We do not use social media tracking cookies beyond the consent-gated Meta Pixel described above. We do not perform cross-site behavioural retargeting outside of the services you have explicitly opted into.

4. Your Choices

You can control cookies through your browser settings. Most browsers let you block or delete cookies. Note that blocking strictly-necessary cookies will break authentication and prevent the platform from working.

We honour the Do Not Track (DNT) browser signal where technically feasible. Note that Sentry and Vercel Analytics do not currently respond to DNT — see their respective privacy policies for opt-out mechanisms.

5. Changes to This Policy

We may update this Cookies Policy from time to time. Material changes will be notified via email or a banner on the platform.

6. Contact

For questions about cookies or this policy, contact us at privacy@allwise.co.nz.