SYMETRIQ — Cookie Policy
Document version: v1.1-DRAFT · Effective launch · Version 1.1 Status: DRAFT FOR LEGAL REVIEW — NOT FINAL. Companion to: Privacy Policy v2, Terms of Service v4.1.
1. What this Policy covers
This Policy explains what cookies and similar technologies (local storage, session storage) SYMETRIQ uses on the public website at symetriq.ai (the "Site") and in the SYMETRIQ application (the "App"), why, and what choices you have. It is part of our Privacy Policy.
In plain terms: cookies are small files a site can save in your browser to remember things. We use almost none, and none for tracking or advertising.
2. The public website sets no cookies
The Site — the marketing pages, the waitlist, and the legal pages — does not set cookies, does not use local storage, and does not load third-party advertising, social-media, or tracking scripts.
We measure Site traffic with Cloudflare Web Analytics, which is cookieless: it does not set cookies, does not fingerprint your device, does not track you across sites, and reports only aggregated page-view statistics to us. It runs without a consent banner because it stores nothing on your device. Cloudflare adds a small script to each page (static.cloudflareinsights.com/beacon.min.js); when it loads, Cloudflare receives your IP address and browser details.
Fonts. The Site serves its fonts from our own domain; it does not contact Google Fonts. The App (the logged-in dashboard) currently loads fonts from Google Fonts (fonts.googleapis.com, fonts.gstatic.com): when your browser fetches a font, Google receives your IP address and browser details. Google states that Google Fonts does not set cookies. We plan to host the App's fonts ourselves too. There is no embedded video, chat widget, or captcha on the Site. The waitlist form sends your entries to our database host, Supabase.
3. The application uses only strictly necessary storage
When you sign in to the App, we store the minimum needed to keep you signed in, keep your account secure, and remember your preferences. None of it is used for advertising or cross-site tracking, and none of it is shared with advertisers.
| Name | Set by | Type | Purpose | Duration |
|---|---|---|---|---|
| sb-*-auth-token | Supabase Auth (our authentication provider) | Holds your signed-in session (JWT). Without it you cannot use the App. | Session; refreshed while active; removed on sign-out | |
| csrf / anti-forgery | SYMETRIQ | Cookie | Protects forms and actions against cross-site request forgery. | Session |
| __cf_bm / cf_clearance | Cloudflare | Cookie | Bot protection and DDoS mitigation at the edge; distinguishes humans from automated traffic. | Up to 30 minutes |
| symetriq-prefs | SYMETRIQ | localStorage | Remembers interface preferences (theme, layout, dismissed notices). Contains no personal data. | Until cleared |
| mfa-device-trust | SYMETRIQ | Cookie | Remembers a device you chose to trust for multi-factor authentication. | 30 days |
These are "strictly necessary" technologies: the App cannot function safely without them, and applicable law does not require consent for them.
4. What we do not use
- No advertising, retargeting, or marketing cookies.
- No cross-site tracking or fingerprinting.
- No social-media pixels or "like" buttons.
- No third-party analytics that set cookies (no Google Analytics, no tag manager).
- No session-replay or heat-map tools.
- No cookies from your Broker or LLM Provider — those services run on their own sites under their own policies; the App communicates with them from our servers, not from your browser.
5. Your choices
- Browser controls. You can block or delete cookies and local storage in your browser. If you block the strictly necessary items in Section 3, you will not be able to sign in or the App will not work correctly.
- Global Privacy Control. We honor GPC signals as an opt-out of sale and sharing of personal data. We do not sell or share personal data, so honoring the signal changes nothing about how the App works.
- Do Not Track. Because we do no tracking, a DNT signal changes nothing; we note it for transparency.
- EEA/UK users at launch: because we set only strictly necessary storage, no consent prompt is required. If we ever introduce a non-essential technology, you will be asked before it is set, and you will be able to refuse it without losing access to the App.
6. Changes
We will update this Policy and its version number before introducing any new cookie or storage technology, and will notify account holders of material changes as described in the Privacy Policy.
7. Contact
Questions about cookies: hello@symetriq.ai.
Draft for legal review. Not legal advice. All bracketed items must be resolved — by inspection of the live Site and App — before publication.