Cookie Policy

Two kinds of thing get stored on your device. The first is strictly necessary — it keeps you signed in, and without it an account is not possible. That needs no permission and cannot be switched off. The second is analytics, which is off unless you turn it on.

There is no advertising cookie, no cross-site tracker, and nothing sold to anyone. Your choice is remembered for six months and can be changed or withdrawn at any moment, from the footer of every page or from the button further down this one.

Authentication

Set by Supabase when you sign in, and used to keep you signed in as you move between pages. They hold a session token, are marked HttpOnly and Secure, and are refreshed on each request. Removing them signs you out. Without them there is no way to have an account at all, which is what makes them strictly necessary and why the law asks for no consent to set them.

Your cookie choice

Your answer to the banner is itself stored, in a first-party cookie named prospexly_consent, for six months. It records only which categories you allowed and when you decided — no identifier, nothing that could single you out. Storing it is what stops the banner asking again on every page, and this site is the only one that can read it.

Theme preference

Your light or dark choice is kept in your browser’s local storage rather than a cookie. It never leaves your device and is not sent to us with requests. It is mentioned here because it is the same kind of thing from your point of view, whatever the technical name.

The site is built to support Google Analytics 4, so we can see which pages people find useful. It loads only after you allow it. If you say no, or say nothing at all, the script is never requested and no analytics cookie is ever set.

Two details worth stating, because they are usually the ones left unsaid. First, advertising signals are switched off explicitly rather than merely left alone — Google treats an unset signal differently from a denied one, and we deny them. Second, the decision is enforced by your browser and not only by our own code: while analytics is not allowed, our Content-Security-Policy does not name Google as a permitted destination at all, so a request there would be refused even if something on the page tried to make one.

Turning analytics back off deletes the cookies it set (_ga and _ga_*) and tells the tag to stop using storage immediately.

As things stand, no measurement identifier is configured on this deployment, so nothing is being collected whatever anyone chooses. We would rather say that plainly than leave a clause here that quietly permits something we are not doing.

Withdrawing has to be as easy as consenting was, which is a requirement rather than a courtesy. Every page carries a “Cookie settings” link in the footer, and this button does the same thing:

Cookie settings

We will ask again if we ever change what the categories cover, because permission given for one description of what we do is not permission for a different one. Otherwise your answer stands for six months.

We measure page performance with Vercel Analytics. It is cookieless, stores nothing on your device, and collects aggregate Web Vitals with no account identifier and no cross-site profile. Because it neither reads nor writes anything on your device it sits outside the consent gate — permission is required for storage and access, not for the existence of measurement.

Payments are handled by Stripe, which sets its own cookies on its own checkout and billing pages when you go through one. Those are covered by Stripe’s privacy policy, not by ours. Card details are entered directly with Stripe and never reach our servers.

This is a different thing from cookies, and worth being clear about because it is the part people ask about.

When you send a sequence through Prospexly, each message can carry a tracking pixel and rewritten links so that you can see opens and clicks. This works by giving every message a unique URL, not by setting a cookie on the recipient’s browser. Recipients are not profiled across sites and nothing is stored in their browser.

You are the sender, so the choice of whether to track is yours, as is the responsibility for disclosing it where the law where your recipient lives requires that. The Acceptable Use Policy covers what that means.

Every browser lets you view and delete cookies and block new ones. If you block ours you can still read the marketing site, the blog and the free email verifier, but you will not be able to stay signed in to an account. Clearing them also removes your stored choice, so the banner will ask again.

Questions: privacy@prospexly.com.