DecodeCreator
DecodeCreator

Cookie Policy

Effective July 15, 2026. Three categories, plain English, one click to change your mind.

We use a single first-party session cookie you can't opt out of (it's how we know you're signed in). Everything else — analytics, marketing — is off by default and only turns on if you explicitly accept it in our cookie banner.

What is a cookie, briefly

A cookie is a small text file the browser saves per website. We also use similar browser-storage APIs (localStorage, sessionStorage) — this policy covers all of them. The point of this page is: what data is stored on your device, and why.

The three categories we use

Every piece of storage we set is one of three types. In the cookie banner you can accept or reject the last two independently.

1. Strictly necessary (always on)

required
sb-<project>-auth-token
Supabase session — keeps you signed in.
Retention: Refreshed on activity; expires after ~1 week idle.Party: First-party (Supabase-issued, we set it on our domain).
theme
Remembers whether you picked light or dark mode.
Retention: Persists until you clear it.Party: First-party (localStorage).
dc-consent
Remembers your cookie-banner choice so we don't nag you every visit.
Retention: 6 months, then we re-ask.Party: First-party (localStorage).
csrf-token / cf-clearance / __Host-*
Anti-CSRF and platform-set anti-abuse cookies from Cloudflare / Railway proxies. Required for the site to function.
Retention: Session or short-lived (minutes to hours).Party: First-party (platform infrastructure).

2. Analytics (opt-in)

off by default
Google Analytics (_ga, _ga_*)
Aggregate visit counts, popular pages, referrer sources. Anonymized IP. We only load Google Analytics AFTER you accept analytics cookies.
Retention: Up to 24 months (Google-controlled).Party: Third-party (Google).
PostHog (ph_*)
Product analytics — which tools people use, which buttons get clicked. Helps us know what to improve. Not linked to your email.
Retention: 12 months.Party: Third-party (PostHog).

3. Marketing (opt-in)

off by default
Google Ads conversion tag (_gcl_*)
Tells Google Ads if you signed up after clicking one of our ads, so we know our ad money isn't wasted. Loads only if you accept marketing cookies.
Retention: Up to 90 days.Party: Third-party (Google Ads).
Meta / X pixel (if enabled)
Same as above but for Instagram/Facebook and X (Twitter) ad platforms. Currently OFF site-wide; will only load after both (a) we enable it and (b) you accept marketing cookies.
Retention: Up to 90 days when enabled.Party: Third-party.

Google Consent Mode v2

When you make a choice in our cookie banner, we send that choice to Google via Consent Mode v2 signals (ad_storage, analytics_storage, ad_user_data, ad_personalization). Google tags installed on our site respect that signal — if you decline, no personal identifiers are sent to Google's ad products.

Default state before you make a choice: everything except strictly-necessary is DENIED. We do not fire analytics or ad tags until you actively opt in.

How to change your choice

  • Use the "Cookie preferences" link in the footer of any page to reopen the banner and update your choice at any time.
  • Or clear the dc-consent value from your browser (DevTools → Application → localStorage) and the banner will re-appear on the next page load.
  • Or block cookies at the browser level — the site works fully without analytics/marketing, though you'll need to accept strictly-necessary or you won't stay signed in.

Do Not Track

We treat a browser-level Do Not Track (DNT) or Global Privacy Control (GPC) signal as a decline for both analytics and marketing cookies. You still see the banner (so we can honor an explicit opt-in if you want to give us analytics), but if you don't interact with it we default to your DNT/GPC signal.

Cookies we do not use

  • We do not use Facebook Pixel by default (currently disabled site-wide).
  • We do not use any cross-site tracking cookies, third-party data broker cookies, or fingerprinting scripts.
  • We do not sell cookie data or share it with data brokers. (See the Privacy Policy for the full "who we share with" list.)

Changes to this policy

If we add a new cookie category (e.g. video-embed cookies from a YouTube tutorial), we'll update this page and re-prompt you in the banner. Existing choices for categories that haven't changed are preserved.

Contact

Cookie questions or complaints: support.decodecreator@gmail.com.

Related: Privacy Policy · Terms of Service · Refund Policy

Cookie Policy — DecodeCreator | DecodeCreator