# Cookie Policy

How Kopai uses cookies and tracking technologies

# Cookie Policy

_Last updated: May 8, 2026_

## What Are Cookies?

Cookies are small text files stored on your device when you visit a website. They help us provide a better user experience and understand how you use our service.

## Cookies We Use

### 1. Essential Cookies (Required)

These cookies are necessary for the service to function. You cannot opt out.

| Cookie Name | Purpose | Duration | Provider |
|-------------|---------|----------|----------|
| `sb-*` | Supabase authentication session | Session/persistent | Supabase |
| `__cf_bm` | Cloudflare bot management | 30 minutes | Cloudflare |
| `__Secure-csrf` | CSRF protection | Session | Kopai |

**Why these are essential:**
- **Authentication cookies** (`sb-*`): Required for secure login and session management. Without these, you cannot access your account.
- **Security cookies** (`__cf_bm`, `__Secure-csrf`): Protect against malicious attacks (DDoS, cross-site request forgery). Critical for platform security.

### 2. Analytics Storage (Optional - Requires Consent)

To understand how visitors interact with our marketing site we run a self-hosted OpenTelemetry Real User Monitoring (RUM) SDK in the browser. The SDK stays inactive until you click **Accept All** in the cookie banner. While analytics is enabled we use two browser-storage entries — these are technically `localStorage` / `sessionStorage` rather than HTTP cookies, but the ePrivacy Directive treats them the same way and they are listed here for transparency.

| Storage key | Storage type | Purpose | Duration | Provider |
|-------------|--------------|---------|----------|----------|
| `kopai-cookie-consent` | `localStorage` | Records your cookie banner choice (essential / analytics) so we don't ask again on every page | Until you withdraw consent or until the policy version is bumped | Kopai |
| `kopai-otel-session` | `sessionStorage` | Tab-scoped random UUID v4 (`session.id`) that lets us tell whether two analytics events came from the same browsing session | Deleted automatically when you close the tab | Kopai |

**What `session.id` is and what it isn't:**
- It is a random UUID generated in your browser (e.g. `b6422eeb-e604-f625-ee90-3b1bc654d808`). It contains no personal data.
- It is **tab-scoped**: opening the site in two tabs creates two independent IDs. Closing the tab destroys the ID — there is no way for us to recognise you on a return visit.
- It is **not** synced across devices, browsers, or to any account.

**Data captured by the analytics SDK while consent is granted:**
- Page paths visited and the order you visited them (e.g. `/`, `/blog/`, `/quickstart/`)
- Referrer page within `kopai.app`
- Click events on the **Sign up** and **Demo** call-to-action buttons (button identifier and destination URL — not the surrounding text you typed)
- Page-load performance (Web Vitals: LCP, FCP, CLS, INP, TTFB) and a list of static resources the page fetched
- Browser metadata reported by your browser: user-agent string, preferred language, platform name, mobile flag
- Display metadata: screen size, viewport size, device pixel ratio
- Network class reported by your browser: effective connection type (e.g. `4g`, `3g`)
- The `session.id` described above

**What we do not capture:**
- We do not capture your IP address in the telemetry payload (Cloudflare necessarily sees it as part of any HTTP request, but it is not stored as a span attribute).
- We do not capture form contents, search queries, keystrokes, mouse movements, or scroll positions.
- We do not run third-party analytics (no Google Analytics, Plausible, Segment, etc.).
- We do not capture JavaScript errors or stack traces from the marketing site.

**Withdrawing consent mid-session:**

You can withdraw analytics consent at any time via the **Reject analytics** button in the footer of every page (single click — no reload). The button flips the `analytics` flag in `kopai-cookie-consent` from `true` to `false`, the OTel SDK shuts down immediately, the `kopai-otel-session` entry is deleted from `sessionStorage`, and no further analytics events leave your browser until you re-grant consent. Re-granting consent in the same tab generates a **new** `session.id` — the old one is gone.

If you want to revisit your full cookie preferences (essential vs. analytics) instead of just opting out of analytics, the **Cookie Settings** button in the same footer resets the banner so you can choose again.

**What we may capture about your network location:**

If you visit Kopai through Cloudflare (the default for our production sites), your browser sends our analytics pipeline two coarse network attributes derived by Cloudflare from your IP address — never the IP itself:

| Attribute | Source | Example | Purpose |
|-----------|--------|---------|---------|
| `cloud.region` | Cloudflare `cf-ipcountry` response header | `HR`, `DE`, `US` | Country-level traffic distribution for capacity planning. ISO 3166-1 alpha-2 country code only — no city or coordinates. |
| `cloudflare.colo` | Cloudflare `cf-ray` response header | `ZAG`, `FRA`, `IAD` | Identifies which Cloudflare data centre served the request, used for performance debugging. Three-letter airport-style code. |

Both are derived server-side by Cloudflare and forwarded to us via standard response headers; we read them in the browser and tag them on the same telemetry that the `session.id` is attached to. They are gated by the same analytics consent — when you reject analytics, neither is collected.

**Legal basis**: Your consent (GDPR Art. 6(1)(a); ePrivacy Directive Art. 5(3))

## Managing Cookies

### Consent Management

When you first visit Kopai, you'll see a cookie consent banner. You can:
- **Accept all**: Enable analytics cookies
- **Essential only**: Only use required cookies
- **Manage preferences**: Choose which cookies to enable

You can change your preferences anytime by clicking "Cookie Settings" in the footer.

### Browser Settings

You can also control cookies via your browser settings:

**Chrome:**
1. Settings > Privacy and security > Cookies and other site data
2. Choose "Block third-party cookies" or "Block all cookies"

**Firefox:**
1. Settings > Privacy & Security > Cookies and Site Data
2. Choose "Delete cookies and site data when Firefox is closed"

**Safari:**
1. Preferences > Privacy > Cookies and website data
2. Choose "Block all cookies"

**Edge:**
1. Settings > Privacy, search, and services > Cookies
2. Choose "Block third-party cookies"

**Note:** Blocking essential cookies will prevent you from logging in to your Kopai account.

### Cookie Duration

- **Session cookies**: Deleted when you close your browser
- **Persistent cookies**: Stored for a specific period (see table above)
- **Revocation**: You can delete all cookies anytime via browser settings

## Third-Party Cookies

We use the following third-party services that may set cookies:

### Supabase (Authentication)
- **Purpose**: User authentication and session management
- **Data collected**: Email, user ID, session tokens
- **Privacy policy**: [Supabase Privacy Policy](https://supabase.com/privacy)
- **Cookie control**: Essential - cannot be disabled without losing login functionality

### Cloudflare (CDN & Security)
- **Purpose**: Content delivery, DDoS protection, TLS termination
- **Data collected**: IP address, user agent, request patterns
- **Privacy policy**: [Cloudflare Privacy Policy](https://www.cloudflare.com/privacypolicy/)
- **Cookie control**: Essential - required for site security and performance

## Your Rights Under GDPR

You have the right to:
- **Withdraw consent**: Change your cookie preferences at any time
- **Access information**: Request details about cookies we use
- **Data portability**: Receive your data in machine-readable format
- **Lodge a complaint**: Contact the Croatian DPA (AZOP) at https://azop.hr

For cookie-related questions or to exercise your rights, contact: hello@kopai.app

## Changes to This Policy

We may update this Cookie Policy to reflect:
- Changes in cookie usage
- New features or analytics tools
- Legal or regulatory requirements
- User feedback and improvements

**Notification:**
- Material changes: Email notification 30 days in advance
- Minor changes: Updated "Last updated" date only

## Children's Privacy

Kopai does not knowingly collect data from individuals under 16 years of age. If you are under 16, please do not use our service without parental consent.

## Contact

For questions about our cookie usage or to exercise your privacy rights:

**Email**: hello@kopai.app

**Data Protection Authority**:
Croatian Personal Data Protection Agency (AZOP)
Selska cesta 136, HR-10 000 Zagreb
Website: https://azop.hr

---

_This cookie policy complies with the EU Cookie Directive (ePrivacy Directive 2002/58/EC), GDPR, and Croatian data protection law._