Cookie Notice
Last updated: August 28, 2026
1. Scope
This notice explains how Closyn LLC d/b/a Crispy uses cookies and similar browser technologies on crispy.sh. It supplements our Privacy Policy. A cookie is a small piece of data stored by a browser; similar technologies include local storage, pixels, and software development kits.
2. Current and contemplated technologies
| Category | Provider and purpose | Duration / activation |
|---|---|---|
| Essential | Supabase authentication for sign-in and session continuity. | Up to 30 days, subject to session refresh. Used when authentication requires it; consent is not requested for strictly necessary use. |
| Essential | crispy_consent records the current consent-policy version and analytics/marketing choices so the site and server can honor them. | Up to 180 days. Contains no account ID, email, IP address, or fingerprint. |
| Functional | crispy_ref and crispy_trial preserve a specifically requested referral or trial benefit and partner attribution. | Up to 90 days depending on the entry path. These may be necessary to deliver the requested referral/trial benefit. |
| Analytics | crispy_attr stores first-touch referrer and campaign attribution server-side. | Up to 90 days and set only after analytics consent. |
| Analytics | PostHog uses a cookie and local-storage key named like ph_<project>_posthog for consented browser analytics and attribution. Browser events may include device, account, and usage data and are not represented as anonymous. Browser session replay, surveys, autocapture, dead-clicks, heatmaps, and performance capture are disabled in the current integration. Separate server-side operational events do not use this browser storage and may run under legitimate interests. | Browser storage lasts up to 180 days and is initialized only after analytics consent. Server-event retention remains pending configuration and contract verification. |
| Analytics | Cloudflare web performance and traffic analytics where zone injection is enabled. | Duration is pending. Intended to activate after analytics consent unless a configured exemption is confirmed. |
| Marketing | Advertising pixels for conversion measurement and retargeting. Potential platforms are Meta, LinkedIn Ads, Google, TikTok, X, and Reddit. | Vendor-specific duration is pending. Intended to activate only when marketing consent is granted and the relevant deployment identifier is configured. |
3. Consent controls and implementation status
Our intended control is to keep non-essential functional, analytics, and marketing technologies disabled until you grant the corresponding consent. You can refuse or later withdraw non-essential consent without losing core account functionality. Consent-gating and final vendor configuration are still being completed. This notice therefore distinguishes intended behavior from controls we have verified as fully deployed; it is not a claim that every intended control is already operational.
4. Your choices
Where a Crispy consent control is available, use Accept all, Reject non-essential, or category controls to change non-essential choices. You may also clear or block cookies through your browser, although blocking essential storage can prevent sign-in. Browser privacy signals, including GPC and DNT, override saved optional choices to off when detected. The broader jurisdiction-specific universal-opt-out request process remains pending counsel review. You can email us to withdraw consent or object to related processing.
5. Changes and contact
We will update this notice as deployments, cookie names, durations, and controls are finalized. Questions or choices can be sent to [email protected].