Legal
Cookie Policy
Published 9/23/2026
Effective: September 2026
Defacta Inc., 1007 N Orange St., 4th Floor, Suite 5722, Wilmington, DE 19801, New Castle, US
This Cookie Policy explains how Defacta Inc. ("Defacta", "we", "us", or "our") uses cookies and similar technologies on defacta.pro, the Defacta web platform, and the Defacta browser extension. Read it together with our Privacy Policy, which explains our processing of personal data, service providers, international transfers, and your rights.
1. Cookies and similar technologies
Cookies are small files that a website or its service providers can store in your browser. We also use browser local storage, session storage, and browser-extension storage. These technologies differ technically, but rules on storing or accessing information on a device can apply to all of them.
Our web application's own state is currently held in local storage and session storage rather than application cookies. Our security infrastructure may also set HTTP cookies, as explained in section 5. The browser extension uses separate extension storage, as explained in section 6.
Local storage does not automatically expire. It remains until the application or browser removes it, or you clear it. Website session storage normally lasts for the tab's page session, including page reloads. Browser session-restoration features may restore that session and its data.
Local storage does not mean that the information is anonymous or never transmitted to us. For example, authentication information is used when your browser communicates with our services, and sign-up answers are saved to your account.
2. Storage used by the website
Names containing <account id>, <report id>, or an ellipsis include a variable identifier. Not every item below is created for every visitor; some are used only when you sign in or use the relevant feature.
Core functions and actions you request
This storage supports authentication, security, recording privacy choices, and completing actions you initiate. It is not used for advertising or cross-site behavioral tracking.
| Name | Storage | Purpose | Retention and removal |
|---|---|---|---|
sb-…-auth-token | Local storage | Supabase authentication session information, including tokens used to keep you signed in and refresh your session. | Retained while the client maintains your signed-in session. Removed on sign-out or when the client clears an invalid session, or when you clear site data. Expiry of an individual access token does not itself erase the stored session. |
defacta.cookie-consent | Local storage | Your website cookie-category choices, the consent-interface version, and the time of your decision. | No automatic time-based expiry. Remains until replaced or cleared. When the applicable choice version changes, the previous choice is no longer relied on and we ask again where needed. |
defacta.billing.intent:<account id> | Local storage | A pending purchase or subscription action and identifiers used to help prevent duplicate submission. | Cleared when the application resolves the action or clears it on sign-out or account change. An unfinished action may remain until one of those events occurs or you clear site data; it has no automatic local expiry. |
defacta.web-check.v1:<account id> | Session storage | A request identifier and request fingerprint used to help prevent duplicate analysis submissions and charges. | Until cleared by the application, replaced by another request, or the tab's page session ends. |
defacta.referral.v1 | Local storage and session storage | Preserves an invitation token while you complete the invitation and sign-up process, including navigation to a sign-in provider. | Cleared after the invitation is successfully applied. If you do not complete the process, the local copy has no automatic expiry and may remain until replaced or cleared. The session copy also ends with the page session. |
defacta.signupAttribution | Session storage | Temporarily holds sign-up questionnaire answers you choose to provide, including how you heard about us, while account creation is completed. | Cleared after successful submission to your account, or when the page session ends. After submission, the server-side answers are governed by our Privacy Policy, not this local-storage period. |
We use the strictly necessary exemption only where the storage or access is necessary to provide a service or feature you request, or another applicable exemption permits it. Describing an item as functional or essential does not by itself make every use of that item exempt from consent.
Interface preferences
These items remember interface choices. They are not used for advertising or to build a profile of your activity across websites.
| Name | Storage | Purpose | Retention |
|---|---|---|---|
report_language | Local storage | Your selected report language. | No automatic expiry; until changed, reset, or cleared. |
defacta.console-tab | Local storage | The workspace tab to restore. | No automatic expiry; until changed, reset, or cleared. |
defacta.sound-on-complete | Local storage | Whether to play a completion sound. | No automatic expiry; until changed, reset, or cleared. |
defacta.auto-start-verification | Local storage | Whether verification starts automatically after extraction. | No automatic expiry; until changed, reset, or cleared. |
defacta.onboarding-tips | Local storage | Which onboarding tips you have dismissed. | No automatic expiry; until reset or cleared. |
defacta.report.embed_full_text:<report id> | Local storage | Your full-text display choice for a report. | No automatic expiry; until changed or cleared. Deleting a server-side report does not necessarily remove this browser preference. |
defacta:analysis-job-modes | Session storage | The analysis mode selected for a run in the current tab. | Until cleared or the page session ends. |
The cookie controls currently show these items under the "Essential" category, and the optional-category switches do not turn them off. You can change or reset each preference through the relevant feature control, or remove all of them by clearing site data for defacta.pro. If you clear them, the core service continues to work, but your preferences are no longer remembered.
3. Website analytics and marketing
We do not currently operate optional website analytics or marketing tracking tools. No optional website product-analytics events are currently sent to an analytics service.
The website's cookie controls currently include "Analytics" and "Marketing" categories. Neither category activates a website analytics or marketing tool at present, regardless of your selection. A choice recorded now is not advance permission for an undisclosed future tool.
Before introducing such a tool, we will explain its purposes, provider, information collected, storage, and retention; update this Policy; and request a new choice before activation where consent is required. We will not activate a tool that requires consent unless you have given valid consent for its disclosed use.
We do not use these technologies for advertising or to track your browsing across unrelated websites. Technical and operational processing is separate from optional product analytics, as explained below.
4. Records of website privacy choices
When you submit a choice through the banner or cookie settings, the website saves it locally and sends a record to our server. The record can include the action taken; selected categories and changes to them; the consent-interface version; the time of the decision and receipt; the page path without its query string or fragment; whether you used the banner or settings; your browser's user-agent string; a hash derived from the request's client IP address; and a request trace identifier.
We do not put your account ID in this audit record. However, the technical information may still be personal data. Hashing an IP address does not make the record anonymous.
We use these records to document and honor privacy choices, demonstrate compliance, and protect the choice-recording endpoint from abuse. Where the GDPR applies, we rely on our legitimate interests in these limited compliance and security purposes, subject to your rights. This is separate from consent to optional analytics or marketing.
The server-side audit records have a 90-day retention period and are removed through scheduled cleanup. The local preference has the separate lifetime described in section 2.
5. Security infrastructure and external services
Cloudflare
Cloudflare helps deliver and protect our website and prevent automated abuse. Depending on the security features triggered, it may set cookies such as __cf_bm or cf_clearance.
__cf_bm, when used, expires after 30 minutes of continuous inactivity. cf_clearance records security-check information; its expiry depends on the security feature and active challenge configuration and is specified in the cookie. These cookies may be renewed when further security checks are performed.
The sign-up flow may display a Cloudflare Turnstile challenge after repeated attempts. A challenge can process technical information about the request, browser, and device even when it does not set a cookie. These functions are used for security, not optional advertising or product analytics. See Cloudflare's cookie documentation and Privacy Policy.
Google sign-in
When you choose "Continue with Google", you are redirected to Google to authenticate. Google may use cookies and similar technologies on its own services under its own policies. Our website cookie controls do not control Google's website.
Stripe checkout
When you make a purchase, checkout opens on Stripe's website in a separate tab. Our current checkout integration does not embed Stripe checkout scripts on defacta.pro. Stripe may use cookies and similar technologies on its own services under its own policies. Our website cookie controls do not control Stripe's website.
Error and operational diagnostics
Our browser application sends diagnostics to our own monitoring service at errors.defacta.pro. Each time the application starts, it sends a start-up message. It also sends a report when an application error occurs, and performance timing for a small sample of page loads. These messages can include the page address, browser and device information, the application version, and error details.
Diagnostics support operation, reliability, and troubleshooting and are separate from optional product-event analytics. They are sent whatever you choose in the cookie controls, because they are not optional analytics. The monitoring service does not store cookies or other data on your device, but the absence of a monitoring cookie does not mean that no technical or personal data is processed.
6. Browser extension
Extension storage
The Defacta browser extension does not use its own cookies. It uses the browser's extension-local and extension-session storage, separately from defacta.pro website storage. This storage is isolated from ordinary webpage scripts, but remains subject to the browser's and device's access and security controls.
The extension stores:
- authentication information;
- interface preferences and privacy choices;
- temporary captured material and analysis state needed to restore work;
- local history, when enabled;
- a count of your completed analyses and the identifiers of up to 20 recent analyses. The extension uses this only to decide when to show the "Help improve Defacta" prompt, which appears after your second completed analysis. It is kept whether or not you turn analytics on, stays on your device, and is not sent to us;
- only when optional product analytics is enabled, a bounded queue of product events and identifiers used to avoid duplicate events.
Authentication, preferences, and the analysis count are kept in extension-local storage until changed or removed through the relevant controls, or the extension is uninstalled. The analysis count has no separate control; uninstalling the extension removes it. Temporary work uses extension-session storage and the extension's tab-lifecycle cleanup. Browser restart or extension reload can also clear session data.
Local analysis history
For a new installation, local analysis history is off by default. You can choose "Off", "7 days", or "30 days" in extension settings. Existing installations may retain a previously configured or migrated history setting.
When enabled, history can include the material you selected or submitted, source URLs and page titles, analysis results, and translations. The history list is limited to the most recent 100 entries for the account within the selected retention window.
The retention window is applied when the extension reads or saves history, rather than by a guaranteed deletion timer. Older data may remain on an inactive device, or where cleanup cannot complete, until the extension processes it or you clear it. Older-format local copies can also require the "Clear history" action to remove them.
Selecting "Off" stops new history entries being saved; use "Clear history" to remove previously stored history. You can also delete individual entries. Clearing local history does not by itself delete reports or other records stored in your online account.
Optional product analytics
Product analytics is off by default and is controlled separately through "Help improve Defacta" in the extension. Accepting website cookie categories does not enable it.
When enabled, it records a fixed list of interface actions, such as requesting or retrying an analysis, opening a report section, using an export, opening history, or submitting structured feedback. Event information includes an event ID, time, extension version, and limited context such as report language, entry point, capture type, text-length range, status, and predefined feedback categories.
Product events are associated with your signed-in account on our server. They are not anonymous. Their event payloads do not include the selected text, source URLs, page titles, report content, translations, or free-form comments. This exclusion concerns product-event analytics, not material that must be processed to provide an analysis you request.
Events are sent to Defacta's API and processed by us and infrastructure providers acting on our behalf, not a separate advertising network. Raw product-event records have a 90-day retention period and are removed through scheduled cleanup.
While analytics is enabled, the extension can buffer up to 100 unsent events locally. It normally attempts to send them in batches approximately every 10 seconds while its analytics client is active. Events older than 24 hours are discarded when the queue is next processed; this is not a guarantee of physical deletion from an inactive device within 24 hours.
You can withdraw consent at any time by switching "Help improve Defacta" off. This stops new product-event collection and clears unsent events and their associated duplicate-prevention state on your device. Switching analytics off does not immediately delete events that were already sent to us; they are deleted when they reach the 90-day retention period. To have them deleted sooner, contact [email protected], and we will delete the product events associated with your account. Statistics already rendered genuinely anonymous may be retained.
Disabling optional product analytics does not disable processing needed to provide requested analyses, manage account usage and credits, protect the service, or diagnose technical faults. These operational records are separate from optional interface-action events.
7. Managing your choices
On the website, use the cookie controls to accept all displayed optional categories, reject optional categories, or customize your choice. You can reopen the controls using the "Manage cookies" button in the bottom-right corner of the web application. Necessary storage is not disabled by rejecting optional categories.
Website choices apply to the current browser storage context. They do not automatically apply to another browser, device, or the extension. Extension history and analytics choices must be managed in the extension's settings.
You can also delete or block cookies and site data through your browser. Doing so may sign you out, remove saved settings, or prevent a requested feature from working. If the website cannot read a valid saved cookie choice, it will not treat that as permission for optional tracking.
Clearing defacta.pro site data does not normally clear extension storage. Use the extension's controls or uninstall the extension to remove its local data. Local deletion does not, by itself, delete server-side records.
Withdrawal does not make processing carried out lawfully before withdrawal unlawful. It does stop further reliance on that consent. For personal-data requests, including access, deletion, or objections, contact [email protected]. Our Privacy Policy explains your rights and how to complain to a relevant supervisory authority.
8. Changes and contact
We may update this Policy as our technologies or practices change. We will show the revised effective date and notify registered users of material changes by email or through the service with at least 30 days' notice where reasonably practicable. Urgent security, legal, or technical changes may require shorter notice.
An update or continued use of the service is not, by itself, consent to a new optional purpose. Where new consent is required, we will obtain it before the relevant processing begins.
For questions about this Policy, contact [email protected].
Defacta Inc., 1007 N Orange St., 4th Floor, Suite 5722, Wilmington, DE 19801, New Castle, US