Cookie Notice
What cookies and browser storage we use, and why. See also our Privacy Policy for the fuller notice on how we handle your data.
Effective date: 6 July 2026
Version: cookies-v1.0-2026-07-06
Status: Published version. DurationX may update this page when legal, operational, or provider requirements change; material changes apply prospectively under the version noted above.
Section 1
Current posture: essential cookies plus disclosed, aggregate analytics
DurationX uses strictly necessary cookies to authenticate users, maintain secure sessions, prevent unauthorised access, and complete requested service operations. The intake wizard stores only the current step number in the browser’s local storage so the interface can reopen at the same step; project answers are saved server-side and are not stored in local storage. These technologies are necessary to provide the requested service and cannot be disabled through a DurationX preference panel, although browser controls may block them and prevent sign-in or form completion.
DurationX also records aggregate, first-party, privacy-safe product-analytics events — page views on our public pages, whether the sample report PDF was downloaded, and whether a qualification form was started or submitted — grouped only by cohort-level attribution (a marketing campaign code, a message variant, a buyer segment) and calendar date. A short-lived, non-cookie browser-storage value (cleared automatically when you close the tab) prevents the same visit from being counted twice; it is never used to identify you or to track you across sites or visits. No individual visitor identity, device fingerprint, tracking pixel, open-rate measurement, or third-party advertising technology is used.
DurationX does not use advertising cookies, cross-site tracking, or any third-party analytics technology. If that changes, this notice and the preference mechanism will be updated before those technologies are activated, and consent will be requested where required.
Section 2
Cookie and browser-storage inventory
| Name / pattern | Provider | Purpose | Duration | Category |
|---|---|---|---|---|
| Supabase auth/session cookie(s) | Supabase | Authenticate users, maintain a secure sign-in session, prevent unauthorised access | Session / short-lived, per Supabase auth configuration | Strictly necessary |
| Intake wizard step index (localStorage, not a cookie) | DurationX (first-party, browser-only) | Reopen the intake wizard at the current step; project answers are saved server-side and are not stored here | Until cleared by the browser or overwritten by a later step | Strictly necessary — disclosed here for completeness though technically local storage, not a cookie |
| Analytics session token (sessionStorage, not a cookie; added 2026-07-22, PV-08) | DurationX (first-party, browser-only) | A purely random, opaque value — never a device fingerprint or a person/recipient identifier — used only so our aggregate product-analytics events (page views, sample downloads, qualification-form progress) do not count the same visit twice within the same day. Never sent to any third party and never used to identify you or track you across sites or visits. | Cleared automatically when the browser tab closes; not persisted across sessions | Functional — disclosed here for completeness though technically session storage, not a cookie; not blockable via a separate DurationX preference panel, but browser controls can clear it |
No advertising, fingerprinting, email open/link tracking, cross-site tracking, or third-party storage technology is enabled. Any future addition will be inventoried, disclosed here, and — where required — blocked until you consent.
Section 3
Managing cookies in your browser
There is no DurationX cookie-preference panel today. Your browser’s own settings can block or clear these cookies and browser storage at any time, but doing so may prevent sign-in, stop the intake wizard from reopening at your last completed step, or cause a single visit to be counted more than once in our aggregate analytics (a minor measurement effect only — never a privacy risk, since no individual record is created either way).