Last updated: 7 AUGUST 2026
This policy explains how conseal.ae and app.conseal.ae use cookies and similar technologies. Read it with our Privacy Policy.
Without these the Service does not work. No consent is required.
| Item | Purpose | Duration |
|---|---|---|
| Authentication / session token (Supabase) | Keeps you signed in and scopes data to your account | Session – 30 days |
| Refresh token | Renews your session without forcing re-login | Up to 30 days |
| CSRF token | Prevents cross-site request forgery | Session |
| Load balancing / routing (Vercel, Cloudflare) | Serves your request from the right edge node | Session |
conseal_consent | Stores your cookie preferences | 6 months |
| Billing session identifier (Stripe) | Completes checkout and prevents payment fraud | Session – 12 months |
Remember preferences: interface language, theme, sidebar state, dismissed prompts, last-open tab, and your currency choice on the pricing page. Up to 12 months.
We use analytics to understand how the product is actually used — which features get adopted, where people drop off, whether new accounts reach activation, which errors are hitting real users. This directly drives what we fix and build next.
| Item | Set by | Purpose | Duration |
|---|---|---|---|
_ga | Google Analytics 4 | Distinguishes one browser from another so visits join up | Up to 24 months |
_ga_<property id> | Google Analytics 4 | Maintains session state for the property | Up to 24 months |
Google Analytics runs on both conseal.ae and app.conseal.ae. It is only loaded after you opt in — decline, and the script is never fetched and no analytics cookie is set. We do not enable Google Signals or advertising personalisation on this property.
We also use PostHog for product analytics. PostHog runs entirely server-side on our own infrastructure (EU region) and sets no cookies on your device. Because it does not store or read anything on your device, it is not a cookie matter — it is covered by section 4 of the Privacy Policy, where we rely on legitimate interests and you may object.
You can decline analytics without losing any product functionality.
We currently use no advertising or marketing cookies. If that changes, this policy will be updated before any such cookie is set.
In the Service. Use the "Cookie settings" link in the footer of either site, or Settings → Privacy in the app, to review and change your choices at any time. Withdrawing consent is as easy as giving it — decline, and the analytics script stops loading on your next page view.
In your browser. Chrome, Safari, Firefox and Edge all let you block or delete cookies in their privacy settings. Blocking strictly necessary cookies will sign you out and prevent the app from working.
Global Privacy Control. We honour GPC signals where legally required.
Do Not Track. There is no agreed standard for DNT and we do not currently respond to it.
For UAE users, non-essential cookies are set on the basis of consent under the PDPL; strictly necessary cookies on the basis of legitimate interests. For users in the EEA, UK and Switzerland, we obtain prior opt-in consent for all non-essential cookies as required by the ePrivacy Directive and GDPR.
Updated whenever our cookie use changes; the date at the top reflects the current version.