This Cookie Policy is incorporated into, and forms part of, the Privacy Policy. It describes the cookies and comparable browser storage mechanisms used on this website and within the Service, and the choices available to a visitor or Customer.

1. Categories of storage

1.1 Strictly necessary. Storage without which the Service cannot function as requested, including an authenticated session cookie, a bot-verification token issued in connection with account creation, storage of a visitor's recorded preference under this Policy, and a short-lived value used to prevent request forgery during sign-in. Strictly necessary storage does not require consent under applicable law and cannot be disabled without disabling the corresponding function of the Service.

1.2 Analytics. A pseudonymous identifier and associated event record used to measure use of this website and the Service, as described in Section 3. Analytics storage is placed only with consent where consent is required by applicable law, and may be withdrawn at any time as described in Section 4.

1.3 No storage described in this Policy is used for third-party advertising, and no storage is shared with an advertising network.

2. Specific mechanisms

2.1 __Host-bl_session — a host-only, HttpOnly authenticated session cookie, inaccessible to script and to any sibling subdomain, valid for up to one hour and refreshed upon sign-in. Strictly necessary.

2.2 A verification cookie issued by Company's bot-mitigation provider during account creation, retained according to that provider's configuration. Strictly necessary for protected sign-up.

2.3 bl.privacy.v1, stored in local storage, records the visitor's or Customer's choice under this Policy and the version of this Policy accepted, until cleared by the browser or replaced by a later choice. Strictly necessary.

2.4 bl.auth.pending, stored in session storage for the duration of an authentication attempt, prevents replay of an authentication response. Strictly necessary.

2.5 A pseudonymous analytics session or device identifier, stored in browser storage, correlates the events described in Section 3 to a single visitor without directly identifying that visitor. Placed only with consent.

3. What analytics records

When consented, or where the visitor has not yet been asked and has not opted out, Company's first-party analytics records: the page or screen viewed; a named feature interaction; page load and engagement timing; the referring page's origin; marketing campaign parameters appended to the link followed, where present; and a coarse device and browser category. Analytics does not record the content of a form field, source code, prompt text, transcript text, a credential, or the target of an arbitrary click. Analytics data is processed by Company and is not disclosed to a third party for that party's own advertising purposes.

4. Managing choices

A visitor may accept or decline analytics storage when first presented with the choice, and may revisit that choice at any time using the "Cookie preferences" control present on every page governed by this Policy. Where a recognized Global Privacy Control or comparable browser signal is received, Company treats that signal as a request to decline analytics storage and any sale or sharing of personal information, without requiring a separate action by the visitor. Declining or withdrawing consent does not affect strictly necessary storage or the visitor's ability to use the Service.

5. Browser controls

A visitor may also control storage directly through browser settings. Clearing site data removes the recorded choice described in Section 2.3 and will sign the visitor out of any active session. Blocking all cookies may prevent the Service from functioning. "Do Not Track" is not a standardized signal and is not honored independently of Global Privacy Control.

6. Changes to this Policy

Company may revise this Policy from time to time by posting a revised version at this URL with an updated effective date.

7. Contact

Planless Inc. — [email protected].