Cookie and Local Storage Policy
A complete register of cookies, local storage, and analytics, including categories, duration, and how to change your choices.
Privacy-first by defaultNecessary technologies operate for the requested feature. Optional analytics is off until opt-in. TGTrack may load on advertising landing pages after consent; Google Ads, GTM, remarketing, and advertising pixels are not loaded.
Scope
This Policy covers cookies, localStorage, sessionStorage, and similar mechanisms on theraphea.com. Cookies are small values available to a browser or server; localStorage keeps data on the device without automatically sending it with each request.
Categories
- Strictly necessary: security, owner session, authentication, and reliable result submission. They cannot be disabled in the panel without breaking a requested function.
- Functional: locale, theme, interface state, and test continuation. They are created after the corresponding user choice or action.
- Analytics: pseudonymous public-article view counting and referral-source attribution from an advertising landing page to Telegram only after consent.
- Advertising: not used. Google Ads, GTM, remarketing, and advertising pixels have been removed from global loading.
- “Required only” is a choice preset, not a separate technology category.
Technology register
Names containing a colon or wildcard identify a key family for a particular test, result, or shell ID. Actual Supabase authentication cookie names may change with the library and live project configuration.
Theraphea cookies and local storage
| Technology | Category | Purpose | Storage | Duration |
|---|---|---|---|---|
| theraphea_cookie_consent | Strictly necessary | Remembers your optional-technology choices. | Cookie | 180 days |
| NEXT_LOCALE | Functional | Remembers the selected language. | Cookie | Browser session |
| theraphea_owner_session | Strictly necessary | Proves the holder may manage a result not linked to an account; the plaintext secret is not stored in the database. | HttpOnly cookie | Browser session |
| Supabase Auth cookies | Strictly necessary | Supports sign-in, one-time passwords, and account recovery. | HttpOnly cookie | Session period set by Supabase |
| theraphea_progress:<testId> | Functional | Lets you continue an unfinished test on this device. | localStorage | Until the test is completed, restarted, or browser data is cleared |
| theraphea_attempt_outbox:<attemptId> | Strictly necessary | Retries a result submission after a temporary network failure. | localStorage | Up to 24 hours; removed at the next expiry check |
| theraphea_result:<uuid> / theraphea_local_result:<attemptId> | Strictly necessary | Temporarily displays a result if server storage is unavailable. | localStorage | Up to 24 hours; removed at the next expiry check |
| theraphea_theme | Functional | Remembers the light or dark theme. | localStorage | Until the setting is changed or browser data is cleared |
| theraphea.dashboard-shell:v1:* | Functional | Remembers interface panel state. | localStorage | Until the setting is changed or browser data is cleared |
| theraphea_blog_viewer_v2 | Analytics | After consent, counts article views with a pseudonymous identifier. | HttpOnly cookie | 180 days |
| TGTrack landing attribution script (api.tgtrack.ru) | Analytics | After consent, identifies the source of a visit from an advertising landing page to Telegram and links it to a subscription. | Third-party technology | Under the TGTrack policy: up to 3 years or until cookies are disabled |
| Google Ads / Google Tag Manager / advertising pixels | Advertising | Not loaded or set in the current version. | Third-party technology | Not applicable |
How choices work
On the first visit, a non-blocking panel presents equally accessible actions: “Allow analytics”, “Required only”, and “Customise”. Analytics is off by default.
Settings show the technologies used on the site: necessary mechanisms always operate, functional ones run after a user action, and optional analytics has a separate switch.
The choice is stored for 180 days. “Cookie Settings” remains available in the footer. A new choice applies to future activity; already produced aggregate statistics may remain under another lawful basis.
Analytics
After opt-in, an article view sends the translation ID, path without query/hash, minimised referrer, time, and technical signals. The server sets a random HttpOnly viewer cookie for up to 180 days and stores an HMAC hash rather than the plaintext ID; opt-out deletes the cookie.
An internal referrer from a test, result, account, authentication, or admin route is discarded; an external referrer is reduced to its origin. Answers, scores, severity, result UUID/URL, email, and account ID are not sent.
The viewer cookie is scoped to /api/blog/view and is not sent by the browser to test, result, account, authentication, or administrative pages.
On advertising landing pages, the TGTrack script from api.tgtrack.ru loads after consent. It changes the Telegram destination link to identify the source of a visit and later subscription. Under the provider policy, its services may process cookies, Telegram ID, and username; the stated cookie period is up to 3 years or until cookies are disabled.
Sensitive routes
Advertising and third-party analytics scripts are not loaded on tests, results, account, authentication, or administrative pages. TGTrack may load only on advertising landing pages and only after consent.
Cookie consent is not consent to process test answers; a separate consent flow is used before a test.
Browser controls
You can remove cookies and localStorage in your browser. This may sign you out and remove an unfinished test, temporary result, theme, and panel settings.
Do Not Track has no uniform mandatory standard. Global Privacy Control is respected for sale and advertising: those activities remain disabled regardless of the signal.
Changes
Before enabling a new optional technology, we will update the register, purpose, vendor, and duration and obtain any required consent before loading it. A policy entry alone does not replace technical blocking.
Contact
Questions about cookies and choices: info@deeppsysolutions.com.