Cookie Policy — Canopy Families

1. Cookies and Similar Technologies

Cookies are small text files stored on a device. Similar technologies include local storage, session storage, scripts, and tags that store or access device information.

This policy describes the technologies implemented by Canopy Families, what they do, which third parties are involved, and how you can control optional analytics.

2. Our Approach

Optional analytics is off by default and starts only after a clear opt-in. Vercel Web Analytics, Vercel Speed Insights and Google Tag Manager are not rendered on child-facing routes even if the device previously opted in. We do not use advertising or retargeting tags.

3. Cookies We Use

Strictly necessary and requested-function technologies — these support authentication, security, consent choices, and features a user asks us to remember.

Technology	Purpose	Duration
Supabase authentication cookies, including the separate child-auth cookie	Keeps the parent or child securely signed in without allowing the two sessions to overwrite each other	Session and refresh lifetimes managed by the authentication service
`canopy_device_token` (Secure, HttpOnly cookie)	Opaque security token for a parent-approved child device; browser scripts cannot read it and the database stores only its hash	Up to 180 days; rotated on use and invalid after the device is revoked
`canopy_analytics_consent_v1` (local storage)	Remembers whether the user accepted or rejected optional analytics	180 days
Registration email (session storage)	Carries an email address from the home-page form to the registration form	Current browser tab session; removed after it is read
Interface preferences (local storage)	Remembers dismissed welcome content and parent-saved learning articles on that device	Until the preference or browser data is cleared
Cloudflare Turnstile security challenge	Uses limited network, browser, device, challenge-interaction, and outcome signals to distinguish genuine parent registration, sign-in or password-change verification attempts from automated abuse. Canopy does not send names, email addresses, passwords, form entries, user communications, or child learning content to Turnstile.	Challenge tokens expire after five minutes and can be used once. Canopy has disabled Turnstile pre-clearance, so it is not configured to set a `cf_clearance` cookie. Other strictly necessary security signals and provider records follow Cloudflare's Turnstile Privacy Addendum and Privacy Policy.

Turnstile is a strictly necessary security control and runs only on parent sign-in, registration and password-change verification. It is not optional analytics and is not controlled by the Analytics settings choice.

Optional analytics — these technologies are disabled until the user selects Allow analytics. They remain disabled on /auth/child and /learn.

Provider / technology	Purpose	Duration
Vercel Web Analytics and Speed Insights	Sends consented page views and anonymous performance data including route and URL, network speed, browser, operating system, device type, country, Web Vitals, metric attribution, SDK information and event time. Vercel states that Speed Insights does not associate data points with an individual visitor or IP address.	No analytics cookie; Web Analytics uses the 24-hour visitor hash described by Vercel, while Speed Insights data remains available for the reporting window of the selected Vercel plan
Google Tag Manager / Google Analytics	Loads the disclosed analytics tags after consent. Advertising storage, ad-user data, and ad personalisation remain denied.	Google Analytics may set `_ga` and `_ga_*` for up to 2 years; the deployed container must not add undisclosed tags

We do not use:

Advertising or retargeting cookies
Social media tracking pixels
Third-party profiling cookies of any kind

4. Managing Cookies

Use the Analytics settings control near the bottom of any non-child page to accept, reject, or withdraw optional analytics. Reject and accept are presented with equal prominence. Withdrawing stops future analytics, switches Google consent to denied, and removes known Google Analytics cookies from the current site.

You can also control and delete storage through your browser. Disabling authentication or security storage, including Turnstile challenge storage, will affect account and child-device functionality.

Browser guides for managing cookies:

Chrome: Settings → Privacy and security → Cookies and other site data
Firefox: Settings → Privacy & Security → Cookies and Site Data
Safari: Settings → Safari → Privacy → Manage Website Data
Edge: Settings → Cookies and site permissions → Cookies and site data

5. Changes to This Policy

If we add new cookies or change how we use existing ones, we will update this page and notify registered users by email where the change is material.

6. Contact

Questions about our use of cookies: [email protected]

Canopy Families is a service of Mackie AI Enterprises Limited (company no. 17107639), registered in England & Wales. ICO registration: ZC110311.