What this covers
This policy covers cookies, local storage, and similar browser technologies on hearthlight.app. It should be read with the Privacy Policy.
Necessary and requested storage
- hearthlight_consent_v1: Records your Google Analytics choice, the policy version, and the decision date. Maximum life: 180 days.
- hearthlight_region: Necessary cookie set by Hearthlight. Stores only consent or open. It lasts one day and is refreshed when the category changes. Hearthlight uses this category to set the Google Analytics default.
- Authentication cookies: Secure session and anti-forgery cookies keep accounts signed in and protect account actions. Names and lifetimes can vary according to the authentication flow and browser security rules.
- Theme and interface preferences: Browser storage remembers a selected appearance, filters, dismissed notices, saved searches, drafts, and other requested interface settings. Each value remains until its feature replaces it or the user clears site data.
- Stripe: Stripe may use necessary fraud-prevention and checkout cookies when a user starts checkout or manages a subscription.
Vercel Analytics
Vercel Analytics counts aggregate visits to eligible public pages without cookies in every region. This measurement continues regardless of your Google Analytics choice.
Both analytics services skip dashboard, admin, login, registration, password reset, and invitation pages. Query strings are removed from page URLs sent to Vercel Analytics.
Optional Google Analytics
When enabled, Google Analytics 4 measures eligible public page visits, referral sources, device and browser details, and general interaction patterns. Its regional defaults and your controls are described below.
- _ga: Distinguishes visitors. Google documents a default expiration of 2 years.
- _ga_<container-id>: Persists session state. Google documents a default expiration of 2 years.
Diagnostics
Sentry receives limited error diagnostics needed to keep the service reliable. Browser session replay and client performance tracing are disabled. The client configuration removes user identity, cookies, request bodies, request headers, and query strings before an error event is sent.
Your choice
Your saved choice to allow or reject Google Analytics takes priority in every region. Google Analytics requires consent in the 27 European Union countries, Iceland, Liechtenstein, Norway, the United Kingdom, and Switzerland. Without a saved choice, it stays off and a banner asks you to opt in. The same rule applies when the region cannot be determined.
Google Analytics is enabled by default in other known regions. If your browser sends Global Privacy Control (GPC) and you have no saved choice, Google Analytics stays off in every region. GPC does not open an automatic consent banner.
Cookie settings is available on eligible public pages. You can allow or disable Google Analytics there. Disabling it stops future Google Analytics loading and clears accessible _ga cookies set by Hearthlight. Keeping Google Analytics off does not limit access to the public site.
Browser controls can also remove site storage, although removing authentication cookies signs an account out.
Contact
Questions can be sent to privacy@hearthlight.app.