Legal terms and conditions

1. Scope

This Policy explains how Ānayati SAS uses cookies and similar technologies on the public website and in the signed-in product. Similar technologies can include local storage, session storage, and comparable browser-side state used to keep the Service secure, functional, and consistent.

This Policy should be read together with our Privacy Notice.

2. Strictly Necessary Cookies And Similar Technologies

Some browser-side technologies are required to provide the service you request, protect accounts, complete sign-in, prevent fraud, or preserve essential settings. These are not used as optional public-site analytics choices.

• Authentication cookies: accessToken and refreshToken are HTTP-only cookies used to keep a signed-in session active.
• CSRF protection: csrf_token is an HTTP-only cookie used to protect forms and authenticated actions.
• Google sign-in safeguards: google_oauth_state and google_oauth_nonce, google_oauth_acquisition, and google_oauth_onboarding_binding are short-lived HTTP-only cookies used only during the Google OAuth flow.
• Apple sign-in safeguards: __Host-anayati_apple_web_oauth_state, __Host-anayati_apple_web_oauth_nonce, __Host-anayati_apple_web_oauth_return_to, __Host-anayati_apple_web_oauth_acquisition, and __Host-anayati_apple_web_oauth_onboarding_binding are secure, HTTP-only cookies used only to validate the Apple OAuth response and return you to the intended Anayati page.
• Language preference: i18next stores your selected interface language so the site can render consistently.

3. Functional Storage And Continuity State

We also use browser storage to preserve user choices and continue certain flows. Examples include consent settings, onboarding continuity, billing-return sync state, feature preferences, and temporary drafts created during sign-up or product use.

• Consent state: anayati_consent_preferences is stored in a cookie and local storage so your public-site consent choices can be reused across visits.
• OAuth registration continuity: anayati_oauth_registration_draft is stored in session storage to preserve the legal and marketing choices you made before completing Google or Apple web sign-in.
• Onboarding continuity and bounded measurement: anayati_onboarding_course_session is a first-party HTTP-only cookie used to preserve the requested onboarding flow, enforce abuse limits, and deduplicate anonymous onboarding milestones. The server stores only a hash of its random value with bounded campaign, milestone, branch, and step state; it does not store onboarding answers or identity in this summary.
• Apple account continuity: __Host-anayati_apple_link and __Host-anayati_apple_unlink are secure, HTTP-only cookies that preserve a short-lived Apple account-link or account-unlink operation.
• Product continuity state: some signed-in flows use session storage or local storage for temporary UI state, feature settings, or billing-return handling.

4. Signed-In Service Telemetry Support

For authenticated accounts, Ānayati uses a mandatory service telemetry model that forms part of the signed-in product. Some client-side state and session identifiers support that operation, including continuity and governed feature handling.

Depending on the feature and account context, this can support navigation continuity, feature usage measurement, interaction handling, quota enforcement, performance monitoring, and governed product behavior inside the signed-in service.

This is distinct from optional public-site analytics, optional marketing measurement, and optional personalization consent. If you create or maintain a signed-in account, the applicable service telemetry is handled under the signed-in service model and can be reduced by age, parental-authority status, and jurisdiction without requiring a new public-site analytics prompt.

5. Public-Site Audience Measurement, Optional Analytics, And Marketing Measurement

Audience measurement without cookies: on public pages such as the home page, articles, briefings, course pages, tool pages and the course-creation page, we use Vercel Web Analytics to count visits and understand how our content is read. It does not place cookies or store anything on your device. Vercel counts a visitor with a hash derived from the incoming request, which Vercel discards after 24 hours. It records the page, the referring site, campaign tags in the link, approximate location, device type, browser and operating system, and a few page events: how far a page was read (25, 50, 75 or 100%) and the section reached, clicks from an article to a tool, a course or course creation, whether a course's sign-in invitation was shown or used, and the opening of the course-creation page. We see these only as aggregated statistics. Because it uses no cookies or device storage, this measurement is not part of the consent banner; see §8 for your choices.

Optional analytics and marketing measurement: when you browse the public site without being signed in, we use our own first-party analytics and the Meta Pixel only after the choice flow required by applicable law; server-side Meta Conversions API events follow the rules in the provider list below. These optional technologies can help us understand public-site visits, pages viewed, navigation patterns, clicks, referral context, performance signals, campaign attribution, and conversion events such as newsletter signup, public create-course intent, account registration, checkout start, or a verified initial paid subscription.

If you refuse optional analytics or marketing measurement, the public site should continue to use only the strictly necessary technologies needed to deliver the page or feature you asked for. The current cookie banner does not grant optional personalization.

Current providers and boundaries:

• Vercel Web Analytics: cookie-free audience measurement of public pages for every web visitor (not in the iOS app). No cookie or browser storage; visitors are counted with a request-based hash that Vercel discards after 24 hours. Page events are limited to reading depth and section, clicks to tools, courses or course creation, the course sign-in invitation, and opening the course-creation page. Vercel acts as our processor.
• Meta Business Tools: campaign and conversion measurement using public acquisition events such as PageView, Lead for newsletter signup or public create-course intent, server-side CompleteRegistration for an eligible adult registration (email, Google or Apple web sign-up), sent unless you refused marketing measurement, InitiateCheckout, and server-side Subscribe for a verified initial paid subscription.
• Meta measurement is not used for course prompts, uploaded learning materials, generated course content, learning performance, OODA/cognitive telemetry, or raw payment card data.
• First-party acquisition analytics: anayati_anonymous_id is an optional 180-day first-party identifier. non_course_telemetry_session_id and related session-storage timestamps last for the browser session and rotate after 30 minutes of inactivity. When analytics is enabled, these can accompany public path, referrer, UTM campaign fields, page-view or signup events, and performance metrics.
• Meta browser storage: _fbp identifies a browser for advertising and analytics and Meta currently documents a lifespan of 90 days. _fbc may store a Meta click identifier when a visitor arrives through a relevant Meta link. The Pixel also transmits online identifiers, page URL and referrer, IP address, user-agent, device or network characteristics, timestamp, and configured event fields to Meta. On paid-ad landing pages, our server also keeps the Meta click identifier from the link in a first-party HTTP-only cookie, anayati_meta_click, for up to 7 days, so that a later registration can be attributed to the ad.
• Meta's Business Tools Terms currently allow Event Data, including Pixel and server-side conversion events, to be retained for up to two years. Meta-controlled durations and uses can change under Meta's policies.
• Global Privacy Control: a supported GPC signal is treated as an opt-out of Meta advertising measurement on that device. It does not turn off strictly necessary storage or independently selected public-site analytics.
• Functional and abuse-prevention identifiers: anayati_referral_token supports referral attribution for up to 30 days. Public demo guest identifiers such as anayati_feature_guest.v1 can last up to 30 days, while feature-specific Feynman, coloring-page, or before/after guest identifiers generally last up to 1 day. Cloudflare Turnstile may receive the challenge token and IP address to prevent automated abuse on protected public forms.
• Anonymous onboarding counters: on /start and on the onboarding pages, registration and verification pages reached from it or from a campaign link, we record anonymous counters (scroll-depth bands, section, button and step views, errors, and samples of slow page performance on /start) grouped only by campaign tags, device type and language. They use no cookie and no identifier and do not depend on the consent banner.

6. Third-Party Services Connected To Browser Storage

Browser-side state can interact with third-party providers used in the Service, including Stripe for billing, Google for OAuth sign-in, Vercel Web Analytics for cookie-free audience measurement of public pages (it stores nothing in your browser), and Meta Business Tools for optional marketing and conversion measurement where enabled. Other service providers such as Azure communication, storage, realtime, AI, or infrastructure providers mainly operate server-side, but the related product flows may still depend on browser state for continuity.

Apple supports Sign in with Apple and the associated account-link and account-unlink flows.

Meta Privacy Policy · Meta Cookies Policy

7. Typical Durations

Durations may change when the product evolves, but current examples include:

• accessToken: up to 1 day.
• refreshToken: up to 7 days.
• csrf_token: up to 1 hour.
• google_oauth_state and google_oauth_nonce, google_oauth_acquisition, and google_oauth_onboarding_binding: up to 10 minutes.
• __Host-anayati_apple_web_oauth_state, __Host-anayati_apple_web_oauth_nonce, __Host-anayati_apple_web_oauth_return_to, __Host-anayati_apple_web_oauth_acquisition, and __Host-anayati_apple_web_oauth_onboarding_binding: up to 30 minutes.
• __Host-anayati_apple_link: up to 10 minutes.
• __Host-anayati_apple_unlink: up to 5 minutes.
• i18next: up to 1 year.
• anayati_consent_preferences cookie: up to 180 days; the corresponding local storage entry can remain until updated or cleared.
• anayati_onboarding_course_session: up to 7 days; its minimal anonymous journey summary is retained for up to 90 days.
• Session storage items such as anayati_oauth_registration_draft: generally until the browser session or tab ends, unless cleared earlier.
• anayati_meta_click: up to 7 days.
• Vercel Web Analytics: no cookie or browser storage; its request-based visitor hash is discarded by Vercel after 24 hours.

8. Your Choices

You can manage optional public-site analytics and marketing measurement through the consent banner or the cookie settings entry point in the footer. The cookie-free audience measurement described in §5 is not controlled by the banner; you can object to it by contacting us at contact@anayati.com, or limit it with browser or extension settings that block analytics scripts.

You can also configure your browser to block or delete cookies, but doing so may break login, security features, language continuity, checkout flows, or other essential parts of the Service.

Blocking strictly necessary technologies does not change the fact that a signed-in account requires the mandatory service telemetry model described in the Terms and Privacy Notice.

9. Changes And Contact

We may update this Policy when our use of cookies and similar technologies changes. For questions, contact contact@anayati.com.