1. Cookies and Similar Technologies
Cookies are small text files stored on a device. Similar technologies include local storage, session storage, scripts, and tags that store or access device information.
This policy describes the technologies implemented by Canopy Families, what they do, which third parties are involved, and how you can control optional analytics.
2. Our Approach
Optional analytics is off by default and starts only after a clear opt-in. Vercel Web Analytics, Vercel Speed Insights and Google Tag Manager are not rendered on child-facing routes even if the device previously opted in. We do not use advertising or retargeting tags.
3. Cookies We Use
Strictly necessary and requested-function technologies — these support authentication, security, consent choices, and features a user asks us to remember.
| Technology | Purpose | Duration |
|---|
| Supabase authentication cookies, including the separate child-auth cookie | Keeps the parent or child securely signed in without allowing the two sessions to overwrite each other | Session and refresh lifetimes managed by the authentication service |
canopy_device_token (Secure, HttpOnly cookie) | Opaque security token for a parent-approved child device; browser scripts cannot read it and the database stores only its hash | Up to 180 days; rotated on use and invalid after the device is revoked |
canopy_analytics_consent_v1 (local storage) | Remembers whether the user accepted or rejected optional analytics | 180 days |
| Registration email (session storage) | Carries an email address from the home-page form to the registration form | Current browser tab session; removed after it is read |
| Practice-game recovery (session storage, when games are enabled) | Keeps the current round reference and any unconfirmed request so a refresh or connection problem can retry the same action. It is scoped to the child profile, not used for tracking, and does not cache question history. | Current browser tab session; pending requests are cleared when confirmed, and the recovery record is cleared on sign-out or choosing a new round |
| Interface preferences (local storage) | Remembers dismissed welcome content and parent-saved learning articles on that device | Until the preference or browser data is cleared |
| Cloudflare Turnstile security challenge | Uses limited network, browser, device, challenge-interaction, and outcome signals to distinguish genuine parent registration, sign-in or password-change verification attempts from automated abuse. Canopy does not send names, email addresses, passwords, form entries, user communications, or child learning content to Turnstile. | Challenge tokens expire after five minutes and can be used once. Canopy has disabled Turnstile pre-clearance, so it is not configured to set a cf_clearance cookie. Other strictly necessary security signals and provider records follow Cloudflare's Turnstile Privacy Addendum and Privacy Policy. |
Turnstile is a strictly necessary security control and runs only on parent sign-in, registration and password-change verification. It is not optional analytics and is not controlled by the Analytics settings choice.
Optional analytics — these technologies are disabled until the user selects Allow analytics. They remain disabled on /auth/child and /learn.
| Provider / technology | Purpose | Duration |
|---|
| Vercel Web Analytics and Speed Insights | Sends consented page views and anonymous performance data including route and URL, network speed, browser, operating system, device type, country, Web Vitals, metric attribution, SDK information and event time. Vercel states that Speed Insights does not associate data points with an individual visitor or IP address. | No analytics cookie; Web Analytics uses the 24-hour visitor hash described by Vercel, while Speed Insights data remains available for the reporting window of the selected Vercel plan |
| Google Tag Manager / Google Analytics | Loads the disclosed analytics tags after consent. Advertising storage, ad-user data, and ad personalisation remain denied. | Google Analytics may set _ga and _ga_* for up to 2 years; the deployed container must not add undisclosed tags |
We do not use:
- Advertising or retargeting cookies
- Social media tracking pixels
- Third-party profiling cookies of any kind
4. Managing Cookies
Use the Analytics settings control near the bottom of any non-child page to accept, reject, or withdraw optional analytics. Reject and accept are presented with equal prominence. Withdrawing stops future analytics, switches Google consent to denied, and removes known Google Analytics cookies from the current site.
You can also control and delete storage through your browser. Disabling authentication or security storage, including Turnstile challenge storage, will affect account and child-device functionality.
Browser guides for managing cookies:
- Chrome: Settings → Privacy and security → Cookies and other site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Settings → Safari → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions → Cookies and site data
5. Changes to This Policy
If we add new cookies or change how we use existing ones, we will update this page and notify registered users by email where the change is material.
6. Contact
Questions about our use of cookies: [email protected]
Canopy Families is a service of Mackie AI Enterprises Limited (company no. 17107639), registered in England & Wales. ICO registration: ZC110311.