# Cookie Policy

**Last updated: October 12, 2026 · Version 2026-10-12**

> **The short version.** We set **no advertising cookies**. Optional **Google Analytics 4**
> on public website pages starts only after you choose **Allow analytics**. Refusing leaves
> it off; **Cookie settings** lets you withdraw later. Before consent, after refusal and
> after withdrawal, the site makes no Google analytics requests or cookieless consent pings.
> Necessary browser storage holds sign-in state, public feature configuration and your
> analytics choice. Analytics does not receive your email, form contents, account tokens,
> prompts, app contents or extension activity.

This policy explains what the **Power** website (power-extension.com) stores in your browser
and why. It forms part of our [Terms of Use](/terms) and [Privacy Policy](/privacy). We are
**Azamat Smailov**, a sole proprietor carrying on business as **GENZAI** (Ontario Business
Identification Number 1001692014), 113 Kingslake Rd, North York, Ontario M2J 3E9, Canada ·
+1 437 258 2280 · privacy@power-extension.com.

---

## 1. What we actually store

| What | Where | Set by | Why | How long |
|---|---|---|---|---|
| Your sign-in session (an access token and a refresh token, under a key beginning `sb-`) | **Local storage**, not a cookie | Supabase, our authentication provider | So you stay signed in between page loads instead of entering a one-time code on every screen | Until you sign out or clear your browser storage; the access token itself expires within an hour and is renewed |
| Public feature configuration (`pwx.pixels.v1`) | **Local storage** | Power | Cache the public configuration used to decide whether an optional choice is available; it is not a visitor identifier | Replaced when refreshed, or removed when you clear site storage |
| Analytics preference (`pwx.consent.analytics.v2`; older versioned records may remain) | **Local storage** | Power | Remember your allow/refuse choice for this Cookie Policy edition; a historical generic choice is not reused to authorize the new analytics purpose | Until replaced or you clear site storage |
| `_ga` and `_ga_*` (only after you allow analytics) | **First-party cookies** | Google Analytics 4 | Pseudonymous visitor/session identifiers for the optional website measurement described below | 12 months, without renewing their expiry on new visits; removed when you withdraw through Cookie settings |

The public configuration can be cached before sign-in. Signing out clears authentication;
it does not necessarily remove the separate configuration and preference records.

**Local storage is not a cookie.** It is a separate browser store, it is never attached to
network requests automatically, and normal website scripts from a different origin cannot read it. Software with access to
your browser profile or authorized browser capabilities may have broader access. We mention it here
because what matters to you is what is kept on your device, not the technical name for it.

## 2. Optional analytics and its limits

With your explicit consent, **Google Analytics 4** helps us understand public-website visits,
referral/campaign sources and confirmed interest-form submissions. We explicitly send
`page_view` and successful `waitlist_join` events. The tag also processes technical
visit/session information. Measurements include pseudonymous cookie identifiers, a permitted
public page path and generic site title, referring website origin without its path or query,
validated campaign source/medium/name where supplied, device/browser characteristics,
language and approximate location derived from network information. Google's location
reporting can include country, region and city; granular collection, when enabled, can
include city-derived coordinates, browser/device and operating-system details and screen
resolution. Other query parameters and
fragments are excluded. Google receives network request information, including your IP
address, when contacted. Google states it discards raw IP addresses after the applicable
geolocation/service processing and does not associate them with user identifiers; see its
[regional IP handling](https://support.google.com/analytics/answer/12017362) and
[handling elsewhere](https://support.google.com/analytics/answer/16871531).
We do not request GPS location or claim this is anonymous data.

We do not send email addresses, form contents, account tokens, prompts or app contents to
analytics or attach a Power account identifier. The tag is not loaded on sign-in, account or
private tester pages or in the extension. Enhanced measurement is OFF. **Google Signals is
OFF in our tag configuration**; advertising personalization is disabled and advertising
consent remains denied. This release adds no Google Ads integration.
Google Analytics user-level and event-level retention is set to **14 months**, with
**reset on new activity OFF**. This setting does not limit standard aggregated reports.
Contact our Privacy Officer for a retention request.

- **No advertising or marketing cookies.** We run no ad network and no retargeting.
- **No social media pixels or share-button trackers.**
- **No session recording, heatmaps, or fingerprinting scripts.**
- **No selling personal information or sharing it for cross-context behavioural advertising.**

We do not use this Site to follow visitors across unrelated websites for targeted advertising.
Do Not Track does not change these practices. Global Privacy Control does not activate optional
tracking; this release has no sale or cross-context advertising-sharing activity to opt out
of. The necessary hosting/account requests below still occur. External websites you choose
to open have their own policies. Applicable rights and future changes are described in the
[Privacy Policy](/privacy).

## 3. Sign-up information, which is not a cookie

The current short homepage interest form collects your email and consent choices under the
[website interest notice](/waitlist-notice), without creating an account, sending an email
now or adding signup metadata. Other account wait-list forms send the product, source page
path without query parameters and browser language with sign-up. It does not use cookies to follow you around the
site, and it does not add a referring URL, campaign tags, screen size, time zone, full
user-agent string or a location lookup to the current sign-up record. Network services
still receive the information needed to deliver and secure their requests.

Earlier sign-ups may retain additional context such as campaign tags or approximate region.
Those existing records are covered by **§2 and §7 of the [Privacy Policy](/privacy)**, along
with your access, correction and deletion options. Updating this site does not erase them.

## 4. Third parties that see a request when you load a page

Loading a page contacts the services that deliver its content or account functions. Website
product videos and posters are served as ordinary media files from our site, without an
embedded YouTube, Instagram or TikTok player. Playing them does not enable analytics.
The following providers can receive requests:

| Who | What they receive | Why |
|---|---|---|
| **Vercel** (our host) | Standard web-server request data, including your IP address, requested file/path and browser details, for delivery and security logs | Hosting |
| **Supabase** | Network/browser request data when an account function or public configuration is requested; your email and sign-in tokens when you sign in | Authentication, account functions and any public configuration request |
| **Google Analytics 4** (only after you allow analytics) | The optional measurement and network request information in section 2 | Understand public-website visits, sources and confirmed interest-form submissions |

**Fonts are self-hosted.** The current Site serves Inter and Inter Tight font files from its
own host, without requesting them from Google. Earlier versions did make Google Fonts
requests; that earlier handling is preserved in the [previous policy](/legal/archive/cookies-2026-09-11.md).

Google may process analytics information outside Canada, including in the United States and
other countries. See [how Google uses information from sites or apps that use its
services](https://policies.google.com/technologies/partner-sites) and [Google's Privacy
Policy](https://policies.google.com/privacy). Cross-border processing and your rights are
also described in our [Privacy Policy](/privacy).

## 5. Your analytics choice

Optional analytics is **off by default**. The consent panel offers **Allow analytics** and
**Decline analytics**. Necessary sign-in storage does not authorize analytics. A previously
saved generic preference does not authorize this policy edition. Refusing analytics does
not prevent browsing, joining the interest list or using your account.

We use **basic consent mode**: the Google tag and analytics collection are blocked until you
allow analytics. Advertising storage, advertising user data and personalization remain
denied. There are **no Google analytics requests or cookieless denied-consent pings** before
consent, after refusal or after withdrawal.

Open **Cookie settings** in the site footer to change your choice. **Decline analytics**
refuses consent; **Withdraw analytics** stops further collection and removes the site's
analytics cookies. Withdrawing an active tag reloads the page; finish an unfinished form
first, as the control explains. Information already sent to Google is not automatically retracted. You
may contact our Privacy Officer about access or deletion of information that can be
identified. Necessary hosting/account requests continue; their purposes are separate.

## 6. Controlling what is stored

You can clear local storage and cookies for this site at any time in your browser settings
(usually under "Privacy", "Site settings", or "Clear browsing data"). Clearing it signs you out
and removes cached configuration and preferences for this site. Extension data is stored
separately; do not clear extension storage unless you intend to remove its local work.

Blocking storage entirely will prevent you from staying signed in, but browsing the public
pages will still work.

## 7. The extension is covered elsewhere

This policy is about the **website**. The Power browser extension separately stores personal-app source, versions/data, drafts, recovery/support records, page placements, optional encrypted vault records, chats, task logs and settings. Approved AI/browser actions can disclose relevant information to external services. That is a different set of facts
with different consequences, and it is described in **§2a of the
[Privacy Policy](/privacy)** — please read that section before installing.

## 8. Changes and contact

We will post any change here with a new date and version. Questions, or a request to delete
what we hold about you: **privacy@power-extension.com**, or write to Azamat Smailov, sole
proprietor carrying on business as GENZAI (Ontario BIN 1001692014), 113 Kingslake Rd, North
York, Ontario M2J 3E9, Canada.

If you are not satisfied with our answer, you may complain to the **Office of the Privacy
Commissioner of Canada** (priv.gc.ca · 1-800-282-1376).