Cookie and Device Storage Policy
Effective date:
Path of the Nine uses technology necessary to provide and secure the service. The Google Tag Manager container is present site-wide so measurement tags can be managed consistently, but Google consent is set to **denied** by default. Optional analytics remain unavailable until you choose **Allow analytics**.
Essential technologies
| Name | Provider and purpose | Maximum lifetime |
|---|---|---|
| Supabase authentication cookie(s), typically named sb-…-auth-token and sometimes split into numbered chunks | Supabase: essential sign-in session | Cookie expiry up to 400 days from refresh; token validity is separately limited by Auth expiry and revocation |
| potn:auth-email | Path of the Nine: session storage to carry the email into code verification | Until successful verification or the browser tab session ends |
| potn:pending-draw | Path of the Nine: session storage for an unfinished reading while signing in | Until saved, cleared, or the tab session ends; unusable after 30 days |
| potn:daily:v1 | Path of the Nine: local storage for the anonymous Daily Card | Until replaced or cleared on this device |
| potn-public-shell-v1 | Path of the Nine: service-worker cache containing only offline HTML, offline CSS and three app icons | Until replaced by an app cache update or cleared in browser settings |
Payment and immediate-delivery consent records are stored on our servers, not in an optional browser cookie. Stripe-hosted payment pages use Stripe’s own essential storage and privacy information.
Cloudflare Turnstile is loaded on sign-in pages for bot and abuse protection. It processes technical browser, device and network signals needed to distinguish legitimate use from automated or abusive traffic. Depending on Cloudflare’s security configuration, essential cookies or similar storage may be used for that purpose. We do not use Turnstile for advertising or cross-site behavioural tracking.
Google Tag Manager and consent
The site includes Google Tag Manager container `GTM-5ZMFCQFK` on every page. The container request itself may send basic technical information such as your IP address and browser request details to Google. Before the container loads, the site sets `analytics_storage`, `ad_storage`, `ad_user_data` and `ad_personalization` to **denied**. We do not use GTM to permit advertising or personalised advertising.
Tags added to the container must respect Google consent checks. Optional analytics tags must not be configured to bypass the `analytics_storage` consent requirement. The no-JavaScript GTM fallback is included for compatibility; no optional analytics tag should be configured to fire through it without consent.
Optional analytics
If you select **Allow analytics**, the site may use:
| Name / technology | Provider and purpose | Maximum lifetime |
|---|---|---|
| potn:analytics-consent:v1 | Path of the Nine local storage: remembers whether you allowed or declined optional analytics | Until you change the choice or clear browser storage |
| Google Analytics 4, when configured | Google: measures privacy-filtered page views and a small set of product events such as Daily Card use, reading starts/completions and checkout milestones | Google Analytics cookies are configured to expire within 390 days; reporting retention is configured separately and should not exceed 14 months |
| Vercel Web Analytics, when enabled | Vercel: privacy-conscious aggregate site traffic measurement | Provider-managed; loaded only after consent |
| Vercel Speed Insights | Vercel: aggregate web-performance measurements | Provider-managed; loaded only after consent |
Analytics is deliberately designed not to send your tarot question, generated reading text, email address, reading/account identifiers, Stripe identifiers, Supabase identifiers or payment details. Dynamic reading URLs are reduced to generic route shapes before GA4 page-view reporting, and only recognised campaign parameters are retained.
We do not use these analytics tools for advertising, cross-site behavioural profiling or personalised advertising. Google advertising signals and ad personalisation are disabled in the application configuration.
You can change your decision at any time using **Analytics choices** in the footer. Choosing **Only essential** keeps Google analytics consent denied. Google Tag Manager itself remains present as the tag-management layer, but optional analytics tags must remain blocked. If you withdraw consent during a session, the page reloads so consent-gated analytics scripts stop running.
You can also clear cookies, local storage and cached app files using your browser or device settings. Clearing them may sign you out, reset Daily Card history on that device, remove offline files or cause the analytics choice to be requested again.
Questions can be sent to privacy@pathofthenine.com.