Version 0.1-draft · prepared 2026-07-05 · effective date pending attorney sign-off · sha256 7f449a982f23
Remy Marlo — Cookie & Tracking Notice (remymarlo.com + portal.remymarlo.com)
DRAFT — attorney review required before publication. Prepared 2026-07-05. Drafted to match the current minimal stack (Next.js/Vercel/Supabase, magic-link + Google auth, "simple analytics" per the design handoff). Must be re-inventoried against the actual deployed site before publication — this notice may only list what actually exists.
Plain-language version
We use the boring cookies that keep you logged in, and a light, privacy-respecting page counter. No ad trackers, no selling your browsing, no third-party ad cookies. That's the whole story.
What we set
| Cookie/tech | Who | Purpose | Type | Lifetime |
|---|---|---|---|---|
Supabase auth tokens (sb-*) |
Supabase (first-party) | keep you signed in to the portal | strictly necessary | session/refresh window |
| Google OAuth cookies | only if you sign in with Google | strictly necessary (functional) | per Google | |
| Anti-abuse / CSRF tokens | us | form and session security | strictly necessary | session |
Analytics [TBD: confirm tool — recommend a cookieless option, e.g. server-side or privacy-first analytics] |
[TBD] |
count visits, see which pages matter | analytics | [TBD] |
| Stripe cookies (when billing launches) | Stripe | fraud prevention at checkout | strictly necessary (payment) | per Stripe |
We do not use: advertising cookies, cross-site trackers, social-media pixels, session-replay tools, or fingerprinting.
Your choices
- Strictly necessary cookies can't be switched off — the portal won't work without login cookies.
- Analytics:
[if a cookieless tool is chosen: "our analytics sets no cookies and collects no personal profiles — nothing to opt out of." Otherwise: provide an opt-out toggle here.] - Browser controls and Global Privacy Control signals:
[we honor GPC for any non-essential category — REQUIREMENTS INPUT if non-essential cookies exist]. - EU/UK visitors: if any non-essential cookies are deployed, a consent banner is required before they're set. Recommendation: keep the stack cookieless-except-auth so no banner is needed — it matches the brand ("no ad-tech") and removes the compliance surface.
Do Not Track / GPC
[Attorney: CCPA requires GPC honoring for sale/share opt-outs — we don't sell/share, state that plainly.] We do not sell or share personal information for cross-context behavioral advertising, so there is nothing to opt out of; we say so in the policy rather than burying it.
Questions: [privacy@remymarlo.com — TBD]. Last updated: [date].
Global Privacy Control
We honor Global Privacy Control (GPC) signals. Since we do not sell or share personal information for advertising and run no non-essential trackers, a GPC signal changes nothing in practice — there is nothing to opt you out of — but we recognize it as a valid opt-out request wherever the law gives it effect.