Cookies

DRAFT — Under legal review. This text is pending Guilherme's legal review. It is published while that review is open, and it may change. It is not legal advice. A placeholder in square brackets is for counsel to complete before this notice comes down.

What this policy covers

A cookie is a small value the browser stores for this site. Similar storage, such as the session storage used only to remember that you dismissed the notice, is described here too. The list under this text is the full set this draft discloses. The names and the session length come from the product constants.

This policy is written for Brazil's LGPD and for the ANPD's guidance "Cookies e Proteção de Dados Pessoais" (October 2022), which is guidance, not a statute. It is also the cookie section of our US notice. We do not run a separate European cookie wall. [LAWYER: add a GDPR/ePrivacy section only if you offer the service to people in the EEA or the UK.]

Essential session cookie

The app uses one essential session cookie so a signed-in person stays signed in. It is HttpOnly and SameSite=Lax. It is not an analytics cookie and it is not a marketing cookie. The legal pages do not set it.

The notice on these pages explains the cookie and links here. Dismissing the notice stores that choice in session storage only. It does not set a cookie, and it does not block the session. You can use the site while the notice is on screen.

Under the ANPD guidance, a cookie that is strictly necessary to provide a service the person asked for can rely on a basis other than consent. We rely on the contract for the signed-in session, and on legitimate interest for keeping that session from being abused. [LAWYER: point this sentence at the legitimate-interest assessment.]

Language cookie

A language cookie may be set when a person saves their language in Settings. It remembers English or Brazilian Portuguese. The legal pages do not set it. The basis is the contract: you asked us to remember the language. If you never save a language, we do not set it.

What we do not use

This draft adds no analytics cookie and no marketing cookie. There is no advertising profile and no cross-site tracking cookie. We do not allow a third party to set a cookie on these pages. [LAWYER: confirm the production host does not inject an analytics or payment-page cookie before the person reaches checkout. Stripe may set its own cookies on Stripe's pages. Those are Stripe's cookies, on Stripe's domain.]

Because there is no non-essential cookie, we do not ask for cookie consent, and we do not use a banner that blocks the page. The ANPD guidance treats consent as the preferred basis for non-essential cookies, especially advertising cookies. We have none.

Retention

The session cookie expires about 12 hours after sign-in. The language cookie stays until you change the language or delete it in the browser. Session storage for the notice disappears when the browser session ends.

Your choices

You can block or delete cookies in the browser. If you block the session cookie, we cannot keep you signed in. If you block the language cookie, the product will not remember a language you save.

That browser control is not the same as a Do Not Sell or Share request. Cookies on this site are not used to sell or share personal information. The request page is Do Not Sell or Share My Personal Information.

Sale and share

The session cookie and the language cookie are not sold and are not shared for cross-context behavioral advertising. Hostinger hosts the site that sets them. [LAWYER: legal name of the transactional email provider] does not set them. Stripe does not set them on our pages. [LAWYER: confirm.]

Changes and contact

We will update this page if the cookie list changes. The version and the date are at the top. The privacy contact is on the Privacy page.