Cookie Policy
Last updated: 2026-06-30
Cookies are small files stored on your device. We keep cookie use to a minimum: we only set what's strictly necessary to run the service and a functional cookie to remember your language. We do not use advertising cookies, and we set no analytics cookies.
For audience measurement we use Vercel Web Analytics, a privacy-friendly tool that uses no cookies and collects only anonymous, aggregated data. It loads only if you allow the analytics category, and never identifies you personally.
Strictly necessary cookies don't require consent. For any non-essential cookie we ask first, and you can change your choice at any time from the cookie settings.
Managing your choices
Open the cookie settings from the menu to review or change your preferences. You can also block cookies in your browser, but the service may not work correctly without the strictly necessary ones.
Other browser storage
We also use your browser's local storage for your theme preference and to carry a conversation across sign-in. This isn't shared with anyone and stays on your device.
Cookies we use
| Name | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
| sb-<project>-auth-token | Supabase | Strictly necessary | Keeps you signed in (authentication session). | Session / refresh token |
| anon_id | nottoobad | Strictly necessary | Anti-abuse counter for the free messages a signed-out visitor may send. Prevents running up AI costs. | 24 hours |
| cookie_consent | nottoobad | Strictly necessary | Remembers your cookie choices so we don't ask on every visit. | 1 year |
| NEXT_LOCALE | nottoobad | Functional | Remembers your interface language. | 1 year |
| __cf_* / Turnstile challenge | Cloudflare | Strictly necessary | Bot detection on the chat (Cloudflare Turnstile). Set on Cloudflare's domain. | Session |
Other browser storage
- theme — Remembers your light/dark theme preference.
- nottoobad:cookie-consent — Mirror of your cookie choices.
- nottoobad:consent-id — Anonymous id to log proof of consent.
- nottoobad:carry-chat — Temporarily carries a signed-out conversation across sign-in.
Sub-processors
| Provider | Purpose | Location |
|---|---|---|
| Vercel Inc. | Application hosting, CDN, request logs, and privacy-friendly, cookieless audience analytics (Vercel Web Analytics, only with your consent). | USA / EU |
| Supabase | Authentication and database (PostgreSQL). | EU (eu-north-1) |
| Google Cloud — Vertex AI (Gemini) | Processes the content of your chat messages to generate replies. | USA / EU |
| Cloudflare, Inc. | Bot protection (Turnstile) on the chat endpoint. | Global |
| Upstash | Rate-limit / quota counters (stores a hashed identifier and IP-derived limits). | EU / Global |
| Resend | Transactional email delivery (account-deletion and tokens-ready notices). Receives your email address to send these messages; not used for marketing. | USA |
| Jina AI | Fallback web-content fetching: when a product page blocks the direct fetch, the URL you paste is relayed to the Jina AI Reader (r.jina.ai) to read the page. | USA |