Your privacy choice
We ask everyone, everywhere, before collecting optional first-party analytics. Accept all and Reject non-essential are equally available. Rejecting or dismissing the panel does not prevent audits, sign-in or checkout. Dismissing is not acceptance. We do not infer your location from your IP address.
Nothing is written to our analytics_events table until you accept. We do not queue events before acceptance. Our cookie_consents table records each choice, including rejection and withdrawal, so we can respect it and keep proof.
Policy version: 2026-10-17.1. A changed version asks you again; collection stays off until you accept the new policy.
Browser storage checked on 2026-10-17.
What analytics collects
With your permission, analytics_events counts page views (a fixed page category, not a URL), audit starts, audit completions, audit failures with a fixed reason category, sign-up starts, sign-up completions, and checkout starts. Properties are limited to fixed categories such as source, grade, plan and sign-up method, plus the event timestamp. Events are not linked to your account, consent record or visitor ID.
No personal details, IP address, full user agent, audited domain, email, free-text input, referrer or query string is stored in analytics. There is no third-party analytics vendor, cross-site tracking, advertising identifier, session recording or fingerprinting.
Analytics events become eligible for deletion after 90 days and are removed by the next daily cleanup.
Proof of your choice
cookie_consents stores a random anonymous visitor ID, your decision, the policy version, the timestamp and your browser's user-agent string (limited to 512 characters). This is consent proof only, separate from analytics. Records cannot be edited; changing your mind adds a new record. Consent records are retained for one year, then removed by a daily cleanup.
The consent cookie and browser preference are strictly necessary to remember and enforce your choice, including rejection. No analytics identifier is added to your browser.
Cookies
| Name | Set by | When | Purpose | Duration | Essential |
|---|---|---|---|---|---|
| aip_consent | AI-Primed | Only after you accept, reject or withdraw | An HttpOnly reference to your consent choice, used to enforce it on the server. Never used to identify analytics events. | 1 year from your latest choice | Yes — strictly necessary |
| __stripe_mid | Stripe (our payment processor) | Only after you open checkout | Fraud prevention for the payment you are making. | 1 year (per Stripe's cookie policy) | Yes — strictly necessary |
| __stripe_sid | Stripe (our payment processor) | Only after you open checkout | Fraud prevention for the current checkout session. | 30 minutes (per Stripe's cookie policy) | Yes — strictly necessary |
| m | Stripe, on m.stripe.com | Only after you open checkout | Device signal Stripe uses to detect payment fraud. | Up to 2 years (per Stripe's cookie policy) | Yes — strictly necessary |
| aip_shell | AI-Primed | When you sign in | Remembers that this browser is signed in so pages can show the signed-in menu straight away. Contains only the value 1 — no account details, and it grants no access. | 30 days, or until you sign out | Yes — strictly necessary |
Other browser storage
These are not cookies, but they live in your browser, so we list them too.
| Name | Set by | When | Purpose | Duration | Essential |
|---|---|---|---|---|---|
| aip:consent | AI-Primed | Only after you make a choice | Remembers the decision, policy version and expiry so optional analytics stops immediately when withdrawn. No visitor identifier. | 1 year from your latest choice, or until browser storage is cleared | Yes — strictly necessary |
| sb-…-auth-token | AI-Primed | When you sign in | Keeps you signed in. Removed when you sign out. | Until you sign out | Yes — strictly necessary |
| aip:device | AI-Primed | When you run an audit | A random ID (not a fingerprint) so free-audit limits apply per person rather than per account. We store only a one-way hash of it. | Until you clear your browser storage | Yes — strictly necessary |
| aip:pending-result | AI-Primed | When you run a free score without an account | Remembers the domain and score so you can save that site to your account after signing up. Removed once saved or dismissed. | Until saved, dismissed or you clear your browser storage | Yes — strictly necessary |
| auth:redirect | AI-Primed | When a sign-in starts from another page | Returns you to the page you were on after signing in. | Removed after sign-in, or when the tab closes | Yes — strictly necessary |
| tsr-scroll-restoration-v1_3 | AI-Primed | As you browse | Restores your scroll position when you press Back. | Until the tab closes | Yes — strictly necessary |
Other services your browser contacts
Fonts are served by AI-Primed, not Google Fonts. Sign-in uses Lovable Cloud and, if you choose Google sign-in, the sign-in provider. Stripe loads its payment script and fraud-prevention cookies only when checkout opens. Security and scrubbed error reporting remain necessary service operations, separate from optional analytics. No new service provider is involved in analytics; records stay in our existing Lovable Cloud database.
Changing your mind
Open Privacy preferences in the footer on any page, or Privacy in Settings, to reject or withdraw at any time. Withdrawal stops optional collection immediately in this browser, and saves a new consent record. Your choice applies to this browser, not every device. Clearing storage may ask you again. Authentication, security and payment storage is not gated behind consent. More on how we handle data is in the Privacy Policy.