Cookie Policy
Last Updated: July 2026 — Effective immediately
This Cookie Policy explains what cookies and similar local-storage technologies ("cookies") we use on profits-compass, why we use them, and the choices you have. We keep it short and specific — no legalese padding.
1. The short version
- We use only first-party cookies. No third-party advertising or cross-site tracking cookies.
- Essential cookies are required for the Service to work and are set automatically. They cannot be disabled.
- Preference and analytics cookies are set only with your consent where consent is required (e.g. EU/UK visitors). You can clear or block them at any time in your browser.
2. Cookies we set
| Name | Purpose | Type | Expiry |
|---|---|---|---|
| profits_compass_token | Authentication session token. Verifies your identity on every request to authenticated endpoints. httpOnly — never readable from JavaScript. | essential | 7 days (rolling, refreshed on use) |
| pc_ref | Remembers the invite code that brought you here, so the new-user signup can be attributed to the referrer. Set by the middleware on first request when the URL contains ?ref=…; persisted for 30 days. | essential | 30 days |
| pc_locale | Stores your preferred display language (one of: en, es, de, fr). Read by the i18n middleware. | preference | 1 year |
| pc_consent | Your cookie consent state. Comma-separated list of granted categories: essential, analytics, marketing. Essential is always on (strictly necessary under GDPR Art. 6(1)(f)). | essential | 180 days (GDPR ePrivacy ceiling) |
| pc_visitor_id | Anonymous, opaque visitor identifier used by the analytics funnel. Never tied to PII. | analytics | 1 year |
| pc_ab_* | Sticky A/B test variant assignment. Examples: pc_ab_pricing_cta_copy, pc_ab_onboarding_3step. | analytics | 1 year |
3. Local storage we set
In addition to cookies, the Service uses browser localStorage for non-sensitive state that does not need to travel with every request:
demo_user_id— your local user id (set after a successful magic-code sign-in). Mirrored toprofits_compass_user_idfor legacy callers.PROFITS_COMPASS_SESSION_ID— current chat session id. Cleared on sign-out. (Replaces the legacyKINETIC_SESSION_IDkey, which is migrated on first visit to/chatand then deleted.)KINETIC_AUTH_TOKEN— non-httpOnly mirror of the auth token for client-side API calls.USER_EMAIL— last email used on the login form (display only, never sent without your action).pc_theme— your light/dark theme preference (lightor absent for default dark).pc_ref— the invite code that brought you here (also kept in thepc_refcookie so it survives a tab close).admin_token— admin console token. Only present for users who have signed into/admin.
You can clear all of these by clearing site data in your browser.
4. Third-party cookies
We do not use advertising networks, Facebook Pixel, Google Ads, or any cross-site tracking cookies. The only third-party that sets cookies on our domain is Stripe (during the checkout flow), and those are functional, scoped to the payment session, and deleted on completion.
5. Your choices
- Browser controls: most browsers let you block, delete, or inspect cookies. See your browser's help pages.
- Opt out of analytics: you can email [email protected] to request that we suppress your
pc_visitor_idfrom event collection. - Clear all site data: clearing site data for our origin will sign you out and reset local preferences.
6. Changes to this policy
We may update this Cookie Policy as we add or remove cookies. When we do, we'll bump the "Last Updated" date above. Material changes will be communicated in line with our Privacy Policy.