Full document
Cookie and Local Storage Policy
Scope
This Policy covers cookies, localStorage, sessionStorage, and similar mechanisms on theraphea.com. Cookies are small values available to a browser or server; localStorage keeps data on the device without automatically sending it with each request.
Categories
- Strictly necessary: security, owner session, authentication, and reliable result submission. They cannot be disabled in the panel without breaking a requested function.
- Functional: locale, theme, interface state, and test continuation. They are created after the corresponding user choice or action.
- Analytics: cookieless Vercel Web Analytics runs when the page loads; Google Analytics through GTM, pseudonymous article‑view counting, and TGTrack start after analytics permission.
- Advertising: Google Ads AW-18328424061 through GTM measures advertising visits and conversions only after separate advertising permission. The application does not send form fields, test answers, or account data and does not implement enhanced conversions, Customer Match, or remarketing.
- “Required only” is a choice preset, not a separate technology category.
Technology register
Names containing a colon or wildcard identify a key family for a particular test, result, or shell ID. Actual Supabase authentication cookie names may change with the library and live project configuration.
| Technology | Category | Purpose | Storage | Duration |
|---|---|---|---|---|
| theraphea_cookie_consent | Strictly necessary | Remembers your optional‑technology choices. | Cookie | 180 days |
| NEXT_LOCALE | Functional | Remembers the selected language. | Cookie | Browser session |
| theraphea_owner_session | Strictly necessary | Proves the holder may manage a result not linked to an account; the plaintext secret is not stored in the database. | HttpOnly cookie | Browser session |
| Supabase Auth cookies | Strictly necessary | Supports sign‑in, one‑time passwords, and account recovery. | HttpOnly cookie | Session period set by Supabase |
| theraphea_progress:<testId> | Functional | Lets you continue an unfinished test on this device. | localStorage | Until the test is completed, restarted, or browser data is cleared |
| theraphea_attempt_outbox:<attemptId> | Strictly necessary | Retries a result submission after a temporary network failure. | localStorage | Up to 24 hours; removed at the next expiry check |
| theraphea_result:<uuid> / theraphea_local_result:<attemptId> | Strictly necessary | Temporarily displays a result if server storage is unavailable. | localStorage | Up to 24 hours; removed at the next expiry check |
| theraphea_theme | Functional | Remembers the light or dark theme. | localStorage | Until the setting is changed or browser data is cleared |
| theraphea.dashboard-shell:v1:* | Functional | Remembers interface panel state. | localStorage | Until the setting is changed or browser data is cleared |
| theraphea_blog_viewer_v2 | Analytics | After consent, counts article views with a pseudonymous identifier. | HttpOnly cookie | 180 days |
| TGTrack landing attribution script (api.tgtrack.ru) | Analytics | After consent, identifies the source of a visit from an advertising landing page to Telegram and links it to a subscription. | Third‑party technology | Under the TGTrack policy: up to 3 years or until cookies are disabled |
| Vercel Web Analytics | Analytics | Counts page views and basic technical dimensions without cookies; loads when a page opens. | Third‑party technology | No cookie; the anonymous visitor hash resets daily |
| Google Tag Manager GTM-NZ3DQMKH / Google Analytics G-7DRVR29H8P | Analytics | The GTM container loads with Consent Mode and storage denied by default; Google Analytics receives full permission only after the analytics choice. | Third‑party technology | Under Google and browser settings; duration depends on the tag and user choice |
| Google Ads measurement AW-18328424061 | Advertising | Measures Google Ads visits and conversions through GTM only after separate advertising permission; GPC keeps advertising permissions denied. | Third‑party technology | Under Google and browser settings; duration depends on the tag and user choice |
- Technology
- theraphea_cookie_consent
- Category
- Strictly necessary
- Purpose
- Remembers your optional‑technology choices.
- Storage
- Cookie
- Duration
- 180 days
- Technology
- NEXT_LOCALE
- Category
- Functional
- Purpose
- Remembers the selected language.
- Storage
- Cookie
- Duration
- Browser session
- Technology
- theraphea_owner_session
- Category
- Strictly necessary
- Purpose
- Proves the holder may manage a result not linked to an account; the plaintext secret is not stored in the database.
- Storage
- HttpOnly cookie
- Duration
- Browser session
- Technology
- Supabase Auth cookies
- Category
- Strictly necessary
- Purpose
- Supports sign‑in, one‑time passwords, and account recovery.
- Storage
- HttpOnly cookie
- Duration
- Session period set by Supabase
- Technology
- theraphea_progress:<testId>
- Category
- Functional
- Purpose
- Lets you continue an unfinished test on this device.
- Storage
- localStorage
- Duration
- Until the test is completed, restarted, or browser data is cleared
- Technology
- theraphea_attempt_outbox:<attemptId>
- Category
- Strictly necessary
- Purpose
- Retries a result submission after a temporary network failure.
- Storage
- localStorage
- Duration
- Up to 24 hours; removed at the next expiry check
- Technology
- theraphea_result:<uuid> / theraphea_local_result:<attemptId>
- Category
- Strictly necessary
- Purpose
- Temporarily displays a result if server storage is unavailable.
- Storage
- localStorage
- Duration
- Up to 24 hours; removed at the next expiry check
- Technology
- theraphea_theme
- Category
- Functional
- Purpose
- Remembers the light or dark theme.
- Storage
- localStorage
- Duration
- Until the setting is changed or browser data is cleared
- Technology
- theraphea.dashboard-shell:v1:*
- Category
- Functional
- Purpose
- Remembers interface panel state.
- Storage
- localStorage
- Duration
- Until the setting is changed or browser data is cleared
- Technology
- theraphea_blog_viewer_v2
- Category
- Analytics
- Purpose
- After consent, counts article views with a pseudonymous identifier.
- Storage
- HttpOnly cookie
- Duration
- 180 days
- Technology
- TGTrack landing attribution script (api.tgtrack.ru)
- Category
- Analytics
- Purpose
- After consent, identifies the source of a visit from an advertising landing page to Telegram and links it to a subscription.
- Storage
- Third‑party technology
- Duration
- Under the TGTrack policy: up to 3 years or until cookies are disabled
- Technology
- Vercel Web Analytics
- Category
- Analytics
- Purpose
- Counts page views and basic technical dimensions without cookies; loads when a page opens.
- Storage
- Third‑party technology
- Duration
- No cookie; the anonymous visitor hash resets daily
- Technology
- Google Tag Manager GTM-NZ3DQMKH / Google Analytics G-7DRVR29H8P
- Category
- Analytics
- Purpose
- The GTM container loads with Consent Mode and storage denied by default; Google Analytics receives full permission only after the analytics choice.
- Storage
- Third‑party technology
- Duration
- Under Google and browser settings; duration depends on the tag and user choice
- Technology
- Google Ads measurement AW-18328424061
- Category
- Advertising
- Purpose
- Measures Google Ads visits and conversions through GTM only after separate advertising permission; GPC keeps advertising permissions denied.
- Storage
- Third‑party technology
- Duration
- Under Google and browser settings; duration depends on the tag and user choice
How choices work
On the first visit, a non‑blocking panel presents Allow analytics, Required only, and Customise. The quick analytics choice does not allow advertising; analytics and advertising measurement have separate switches in settings.
The choice is passed to Google Consent Mode. Analytics and advertising storage, advertising user data, and personalisation are denied by default. Global Privacy Control forcibly keeps advertising permissions denied.
The choice is stored for 180 days. “Cookie Settings” remains available in the footer. A new choice applies to future activity; already produced aggregate statistics may remain under another lawful basis.
Analytics
After opt‑in, an article view sends the translation ID, path without query/hash, minimised referrer, time, and technical signals. The server sets a random HttpOnly viewer cookie for up to 180 days and stores an HMAC hash rather than the plaintext ID; opt‑out deletes the cookie.
An internal referrer from a test, result, account, authentication, or admin route is discarded; an external referrer is reduced to its origin. Answers, scores, severity, result UUID/URL, email, and account ID are not sent.
The viewer cookie is scoped to /api/blog/view and is not sent by the browser to test, result, account, authentication, or administrative pages.
On advertising landing pages, the TGTrack script from api.tgtrack.ru loads after consent. It changes the Telegram destination link to identify the source of a visit and later subscription. Under the provider policy, its services may process cookies, Telegram ID, and username; the stated cookie period is up to 3 years or until cookies are disabled.
Sensitive routes
Vercel Web Analytics and GTM are connected in the promo.theraphea.com advertising application but are not embedded in the main platform’s test, result, account, authentication, or administrative routes. TGTrack may load only on advertising landing pages and only after optional analytics is allowed.
Cookie consent is not consent to process test answers; a separate consent flow is used before a test.
Browser controls
You can remove cookies and localStorage in your browser. This may sign you out and remove an unfinished test, temporary result, theme, and panel settings.
Do Not Track has no uniform mandatory standard. We do not sell data. The cookie panel respects Global Privacy Control by keeping ad_storage, ad_user_data, and ad_personalization denied; analytics and TGTrack remain separately controllable.
Changes
Before enabling a new optional technology, we will update the register, purpose, vendor, and duration and obtain any required consent before loading it. A policy entry alone does not replace technical blocking.
Contact
Questions about cookies and choices: info@theraphea.com.