Legal terms and conditions

1. Scope

This Policy explains how Ānayati SAS uses cookies and similar technologies on the public website and in the signed-in product. Similar technologies can include local storage, session storage, and comparable browser-side state used to keep the Service secure, functional, and consistent.

This Policy should be read together with our Privacy Notice.

2. Strictly Necessary Cookies And Similar Technologies

Some browser-side technologies are required to provide the service you request, protect accounts, complete sign-in, prevent fraud, or preserve essential settings. These are not used as optional public-site analytics choices.

• Authentication cookies: accessToken and refreshToken are HTTP-only cookies used to keep a signed-in session active.
• CSRF protection: csrf_token is an HTTP-only cookie used to protect forms and authenticated actions.
• Google sign-in safeguards: google_oauth_state and google_oauth_nonce, google_oauth_acquisition, and google_oauth_onboarding_binding are short-lived HTTP-only cookies used only during the Google OAuth flow.
• Apple sign-in safeguards: __Host-anayati_apple_web_oauth_state, __Host-anayati_apple_web_oauth_nonce, __Host-anayati_apple_web_oauth_return_to, __Host-anayati_apple_web_oauth_acquisition, and __Host-anayati_apple_web_oauth_onboarding_binding are secure, HTTP-only cookies used only to validate the Apple OAuth response and return you to the intended Anayati page.
• Language preference: i18next stores your selected interface language so the site can render consistently.

3. Functional Storage And Continuity State

We also use browser storage to preserve user choices and continue certain flows. Examples include consent settings, onboarding continuity, billing-return sync state, feature preferences, and temporary drafts created during sign-up or product use.

• Consent state: anayati_consent_preferences is stored in a cookie and local storage so your public-site consent choices can be reused across visits.
• OAuth registration continuity: anayati_oauth_registration_draft is stored in session storage to preserve the legal and marketing choices you made before completing Google or Apple web sign-in.
• Onboarding continuity and bounded measurement: anayati_onboarding_course_session is a first-party HTTP-only cookie used to preserve the requested onboarding flow, enforce abuse limits, and deduplicate anonymous onboarding milestones. The server stores only a hash of its random value with bounded campaign, milestone, branch, and step state; it does not store onboarding answers or identity in this summary.
• Apple account continuity: __Host-anayati_apple_link and __Host-anayati_apple_unlink are secure, HTTP-only cookies that preserve a short-lived Apple account-link or account-unlink operation.
• Product continuity state: some signed-in flows use session storage or local storage for temporary UI state, feature settings, or billing-return handling.

4. Signed-In Service Telemetry Support

For authenticated accounts, Ānayati uses a mandatory service telemetry model that forms part of the signed-in product. Some client-side state and session identifiers support that operation, including continuity and governed feature handling.

Depending on the feature and account context, this can support navigation continuity, feature usage measurement, interaction handling, quota enforcement, performance monitoring, and governed product behavior inside the signed-in service.

This is distinct from optional public-site analytics, optional marketing measurement, and optional personalization consent. If you create or maintain a signed-in account, the applicable service telemetry is handled under the signed-in service model and can be reduced by age, parental-authority status, and jurisdiction without requiring a new public-site analytics prompt.

5. Optional Public-Site Analytics And Marketing Measurement

When you browse the public site without being signed in, we may use optional analytics, advertising measurement, or similar public-acquisition technologies only after the choice flow required by applicable law. Today that can include Vercel Analytics for site measurement and Meta Business Tools, including Meta Pixel and Meta Conversions API, for campaign and conversion measurement.

These optional technologies can help us understand public-site visits, pages viewed, navigation patterns, clicks, referral context, performance signals, campaign attribution, and conversion events such as newsletter signup, public create-course intent, account registration, checkout start, or a verified initial paid subscription.

If you refuse optional analytics or marketing measurement, the public site should continue to use only the strictly necessary technologies needed to deliver the page or feature you asked for. The current cookie banner does not grant optional personalization.

Current optional providers and boundaries:

• Vercel Analytics: public-site usage and performance measurement.
• Meta Business Tools: campaign and conversion measurement using public acquisition events such as PageView, Lead for newsletter signup or public create-course intent, server-side CompleteRegistration for an eligible completed Google or Apple web registration, InitiateCheckout, and server-side Subscribe for a verified initial paid subscription.
• Meta measurement is not used for course prompts, uploaded learning materials, generated course content, learning performance, OODA/cognitive telemetry, or raw payment card data.
• First-party acquisition analytics: anayati_anonymous_id is an optional 180-day first-party identifier. non_course_telemetry_session_id and related session-storage timestamps last for the browser session and rotate after 30 minutes of inactivity. When analytics is enabled, these can accompany public path, referrer, UTM campaign fields, page-view or signup events, and performance metrics.
• Meta browser storage: _fbp identifies a browser for advertising and analytics and Meta currently documents a lifespan of 90 days. _fbc may store a Meta click identifier when a visitor arrives through a relevant Meta link. The Pixel also transmits online identifiers, page URL and referrer, IP address, user-agent, device or network characteristics, timestamp, and configured event fields to Meta.
• Meta's Business Tools Terms currently allow Event Data, including Pixel and server-side conversion events, to be retained for up to two years. Meta-controlled durations and uses can change under Meta's policies.
• Global Privacy Control: a supported GPC signal is treated as an opt-out of Meta advertising measurement on that device. It does not turn off strictly necessary storage or independently selected public-site analytics.
• Functional and abuse-prevention identifiers: anayati_referral_token supports referral attribution for up to 30 days. Public demo guest identifiers such as anayati_feature_guest.v1 can last up to 30 days, while feature-specific Feynman, coloring-page, or before/after guest identifiers generally last up to 1 day. Cloudflare Turnstile may receive the challenge token and IP address to prevent automated abuse on protected public forms.

6. Third-Party Services Connected To Browser Storage

Browser-side state can interact with third-party providers used in the Service, including Stripe for billing, Google for OAuth sign-in, Vercel Analytics for public-site optional analytics where enabled, and Meta Business Tools for optional marketing and conversion measurement where enabled. Other service providers such as Azure communication, storage, realtime, AI, or infrastructure providers mainly operate server-side, but the related product flows may still depend on browser state for continuity.

Apple supports Sign in with Apple and the associated account-link and account-unlink flows.

Meta Privacy Policy · Meta Cookies Policy

7. Typical Durations

Durations may change when the product evolves, but current examples include:

• accessToken: up to 1 day.
• refreshToken: up to 7 days.
• csrf_token: up to 1 hour.
• google_oauth_state and google_oauth_nonce, google_oauth_acquisition, and google_oauth_onboarding_binding: up to 10 minutes.
• __Host-anayati_apple_web_oauth_state, __Host-anayati_apple_web_oauth_nonce, __Host-anayati_apple_web_oauth_return_to, __Host-anayati_apple_web_oauth_acquisition, and __Host-anayati_apple_web_oauth_onboarding_binding: up to 30 minutes.
• __Host-anayati_apple_link: up to 10 minutes.
• __Host-anayati_apple_unlink: up to 5 minutes.
• i18next: up to 1 year.
• anayati_consent_preferences cookie: up to 180 days; the corresponding local storage entry can remain until updated or cleared.
• anayati_onboarding_course_session: up to 7 days; its minimal anonymous journey summary is retained for up to 90 days.
• Session storage items such as anayati_oauth_registration_draft: generally until the browser session or tab ends, unless cleared earlier.

8. Your Choices

You can manage optional public-site analytics and marketing measurement through the consent banner or the cookie settings entry point in the footer.

You can also configure your browser to block or delete cookies, but doing so may break login, security features, language continuity, checkout flows, or other essential parts of the Service.

Blocking strictly necessary technologies does not change the fact that a signed-in account requires the mandatory service telemetry model described in the Terms and Privacy Notice.

9. Changes And Contact

We may update this Policy when our use of cookies and similar technologies changes. For questions, contact contact@anayati.com.