Cookie and Browser Storage Notice

Strictly necessary storage

Authentication, refresh, CSRF, MFA challenge, legal-confirmation, security, load-balancing, and saved consent-choice storage is used only where needed for the requested session, security, or preference.

• Necessary storage is not disabled by rejecting optional analytics.
• Session and security cookies use bounded lifetimes and appropriate Secure, HttpOnly, and SameSite settings for their role.
• A cookie-choice record may be kept for up to 365 days unless changed or removed sooner.
• The exact name, purpose, provider, lifetime, and access scope of each necessary item must match the deployed inventory.

A real and reversible choice

Optional storage is off until the visitor makes an affirmative choice. Accept and Reject are presented with equal prominence, without preselected optional purposes or misleading design.

Cookie Settings remains available so withdrawal is as easy as acceptance. Withdrawal stops future optional collection and removes optional identifiers where technically controlled by GutMask.

• Ignoring or closing a banner is not consent.
• Account Terms, the Privacy Notice, and product admission are separate from cookie consent.
• Refusal does not block the public site or required account functions.
• A new optional purpose or provider requires new information and a new choice before activation.

Optional first-party landing analytics

After analytics opt-in, GutMask may record landing impressions, page views, and clicks using a random first-party visit token. The token contains no email address, account ID, or user ID.

The intended first release has no third-party analytics, advertising scripts, tracking pixels, or cross-site tracking.

• No analytics assignment, visit identifier, or attribution is created before opt-in.
• Landing events are retained for up to 90 days and are then subject to scheduled deletion.
• Analytics is not used for eligibility, pricing, sanctions, or significant automated decisions.
• Browser privacy signals are respected where required by applicable law and the implemented settings.
• Rejecting analytics does not reduce product rights.

Inventory and questions

The final published inventory is generated from the exact deployed first-party code and configuration; a planned integration is not listed as active.

• Browser preferences such as language, theme, or local shell state are stored only when requested.
• Questions and rights requests: privacy@gutmask.xyz
• This draft is not evidence that optional analytics is enabled on a live deployment.
• Changes to this notice do not revive a withdrawn choice.