Cookie policy

1. What we use and why

Strictly necessary (always on, no consent required): Supabase session and authentication, language preference, CSRF protection, security and fraud prevention, checkout with Creem and management of earlier Mercado Pago transactions, and human verification with Cloudflare Turnstile. Without them you cannot sign in or pay.

Optional analytics (only with your opt-in): PostHog for usage measurement and masked session replay, served through our own /ingest proxy. If you reject, no analytics identifiers are set. Vercel Analytics and Speed Insights, when enabled in production, run without cross-site tracking cookies.

Third parties that may set their own identifiers when you use the related feature: Google (sign-in), Creem (checkout) and Mercado Pago (earlier transactions), Cloudflare (captcha and security). Each is governed by its own policy.

2. Duration and storage

Session and security: short-lived cookies that expire at sign-out or within days. Language and cookie-consent preference (local key vocloner-consent): kept in your browser until you delete it or change it in the banner.

PostHog, only after opt-in: localStorage plus cookie persistence to remember visits and replay masked sessions. After rejection or withdrawal we stop initializing it; later events are not captured.

3. How to accept, reject, or withdraw consent

On your first visit you see a banner with two choices: accept analytics or continue with necessary-only. Your choice is stored in this browser. You can change it by clearing site storage or emailing support@vocloner.org from your account email.

You can also block or delete cookies in your browser, use private browsing, or use blocking extensions. Some features may ask you to sign in again. Blocking necessary cookies may prevent use of the studio, voices, or checkout.

4. Global Privacy Control and Do Not Track

When your browser sends a Global Privacy Control (GPC) signal, we treat it as a rejection of optional purposes and as a request not to sell or share identifiers for cross-context behavioral advertising, where that signal is enforceable.

Do Not Track has no common enforceable standard; we treat it as a privacy hint, while the guaranteed response is GPC plus the banner.

5. Children and sensitive data

We do not use cookies to infer sensitive data or to profile children. Vocloner is not directed at children and optional measurement does not seek to identify them.

6. Changes and contact

If we add a new optional purpose, we will update this page, the date above, and the banner where appropriate. For cookie questions or to withdraw consent, email support@vocloner.org. Do not include passwords or full card details.

This page is an operational notice and should be reviewed by counsel before adoption as a final policy in any jurisdiction. It is not legal advice.