1. Strictly necessary
- Authentication cookies (Supabase). Keep you signed in and secure your session. Set when you sign in; cleared when you sign out or the session expires. The Service cannot work without them.
- Sign-in device cookie (
oc_signup_device). A random, server-issued identifier used with rate limits to reduce automated sign-in abuse. It is HttpOnly, is not used for advertising, and lasts up to one year. - Cloudflare Turnstile. Runs on the sign-in form to distinguish people from automated abuse. Its short-lived challenge data is strictly necessary for security and is not used by us for advertising.
2. Functional
- Referral cookie (
oc_ref). Remembers the first referral code that brought you here so the referrer can receive credit after your first paid checkout; later referral links do not replace it. Set by our server as an HttpOnly first-party cookie (with a browser-storage backup) and lasts 30 days or until the referral is recorded.
3. Analytics
- Anonymous browser identifier and campaign data. Stored in your browser’s local storage: a random identifier, campaign (UTM) parameters, and simple view flags. Used to understand how the product is used and where visitors come from. Persists until you clear browser storage.
- First-party product events. Actions such as page views, generation started or failed, and checkout started are sent to our own servers and associated with your account or the anonymous identifier. These first-party events never leave our infrastructure.
- Google Analytics (opt-in only). If — and only if — you accept analytics in the consent banner, we load Google Analytics 4, which sets
_gaand_ga_*cookies (first-party, up to 2 years) and sends usage measurements such as pages viewed, sign-ups, generations, and purchases to Google. We never send prompts, uploads, generated media, email addresses, or other free-text content to Google, and we keep Google’s advertising features (Google Signals and ads personalization) turned off. Your consent choice itself is stored in a first-party cookie (oc_analytics_consent, 180 days). If you decline or ignore the banner, nothing loads and nothing is sent to Google. - PostHog product analytics (opt-in only). The same consent choice loads PostHog. It sets a first-party
ph_*cookie so later page views in this browser can be tied together, and it sends usage measurements — pages viewed, signup and pricing clicks, checkout started, and a subscription return — to PostHog Cloud in the United States (us.i.posthog.com). Session replay, heatmaps, surveys, and automatic capture of clicks or form text stay off. We do not send prompts, uploads, generated media, or email addresses. If you decline or ignore the banner, PostHog is not initialized and nothing is sent. - Cloudflare performance analytics. Our host, Cloudflare, may collect aggregate performance measurements (such as page-load timing) that are not used to profile you across sites.
4. Payments
When you check out, Stripe sets its own cookies on Stripe’s pages to process the payment and prevent fraud. Those cookies are governed by Stripe’s privacy policy.
5. Your controls
Google Analytics and PostHog are strictly opt-in: they never run unless you accept, and you can change your choice at any time with the “Cookie preferences” link in the site footer. Withdrawing consent stops further measurement to Google and PostHog. You can also clear or block cookies and local storage in your browser settings at any time. Blocking authentication cookies will prevent sign-in; clearing local storage resets the anonymous analytics identifier. Because we do not sell or share personal information and use no cross-site advertising trackers, there is no sale or targeted-advertising to opt out of, and opt-out preference signals such as Global Privacy Control have no additional effect beyond your explicit consent choice on this site.
6. Changes and contact
If we add a tracking technology, we will update this notice and its version number first. Questions: privacy@offlinecreatorstudio.com. See also the Privacy Policy.