Cookie Policy

Last updated: 5 August 2026 Effective date: 23 April 2026

1. What this policy covers

This Cookie Policy explains how ReplySmooth (operated by Bhupendra Singh, sole proprietor trading as ReplySmooth) uses cookies and similar browser-storage technologies when you use our Service.

It should be read alongside our Privacy Policy, which explains the broader picture of what data we collect and how we use it.

2. What cookies and browser-storage are

A cookie is a small piece of text that a website stores in your browser so it can recognise you across page loads — for example, to keep you signed in. Local storage and session storage are similar but technically different mechanisms, all under the same umbrella for the purposes of this policy.

3. Cookies and storage we use

Most of what we store is essential to running the Service. The non-essential exceptions are traffic measurement (sections 3.5 and 3.8), advertising on our free public pages (section 3.6), and product analytics (section 3.7).

We do set two cookies of our own, for traffic measurement. They are the Google Analytics cookies described in section 3.8, and they are the only cookies we set for our own purposes. Everything else in this section is either browser storage that stays on your device, or a cookie placed by a provider — growme_version from the Grow tool in section 3.5 (which also keeps a visitor number in local storage and loads an advertising identity tool, both described there), and Cloudflare's bot-protection cookies in section 3.2.

If you are in the European Economic Area, the United Kingdom or Switzerland, we ask you before any of this happens. Nothing from Google Analytics is loaded, and no analytics cookie is set, unless you choose Accept on the notice we show you. Choose Decline and nothing is loaded and nothing is stored — we remember only your answer, on your own device, so we do not ask again.

What changed, and when.

• 4 August 2026 — until this date the policy said we set no cookies at all for our own purposes, which was true. Adding Google Analytics changed that, and this section was rewritten on the same day the change was made.
• 5 August 2026 — section 3.5 said the Grow tool "displays nothing on the page" and described its storage only vaguely. Both were wrong once the tool was switched on: it adds a small link at the bottom of each page, keeps a visitor number in local storage, and loads an advertising identity tool (UID2). Corrected as soon as we checked what it actually does.

3.1 Authentication (essential)

If you block or clear this storage, you will be signed out and will need to sign in again.

3.2 Bot protection (essential)

We only see a pass/fail result from Cloudflare — we do not see the contents of these cookies.

3.3 App state (essential, not technically a "cookie")

3.4 Things the app remembers on your device (essential)

These are stored in your browser's local storage. They stay on your device, are never sent to us as cookies, and you can clear them at any time (section 5).

3.5 Traffic measurement (not essential)

We run Grow by Mediavine, a free tool from an advertising network, so they can verify our visitor numbers before we apply to work with them. It shows no ads, and it adds one small link reading "Grow Account Page" at the very bottom of each page, below our own footer.

The one cookie it sets:

What it keeps in your browser's local storage (on your device, not a cookie):

• growMeSnowplowUserInfo — a random visitor number and a visit number, so a returning visitor is not counted twice, along with how many visits you have made and when the last one was.
• grow-faves:accessToken, grow-faves:refreshToken, grow-faves:expirationTime — sign-in tokens for the Grow account feature, used only if you choose to use it.

It also loads an advertising identity tool called UID2, from cdn.prod.uidapi.com. This is a system advertisers use to recognise the same person across different websites, normally by matching an email address you have given somewhere. We do not give it your email address, and when we checked, it had not stored any identifier for us. If you use an ad blocker it does not load at all. We did not choose to add this — it arrived as part of the Grow tool — and we are recording it here because it is on the page.

Grow decides for itself, on its own servers, what it may store based on where you are, so what it keeps in Europe may differ from the above.

3.6 Advertising (not essential)

No ads are currently shown anywhere on the Service. Our free public pages carry Google AdSense code, which is loaded while our account with Google is being set up, but no ad units are placed on any page and nothing advertising-related is displayed to you. Google's code may still store cookies or similar identifiers on your device.

If and when ads begin to appear:

• United States — some state laws let you opt out of personalised advertising, through the opt-out control shown where required and through Google's Ad Settings.
• Everywhere else — you can switch off ad personalisation at any time in Google's Ad Settings.

We will update this policy before ads start being displayed, and where the law requires it we will ask for your consent first.

The signed-in app at /app carries no advertising.

3.7 Product analytics (not essential)

We measure product usage with PostHog (see Privacy Policy, section 5). Outside the EEA, UK and Switzerland, PostHog keeps one anonymous random identifier in your browser's local storage so a returning visitor is recognised as the same person across visits — this lets us count real people rather than repeat visits, and see whether a feature gets used again. It is not a cookie, it does not identify you personally, and it is never used to follow you across other websites.

3.8 Traffic measurement — Google Analytics (not essential)

We use Google Analytics 4 to count visits and pages viewed. We use it for one narrow reason: advertising networks will not consider a website unless its visitor numbers come from Google Analytics, and they do not accept figures from any other source. It measures traffic only — it is not used to build a profile of you, and nothing you type into the Service ever reaches it.

This is the one place we set cookies of our own.

Neither cookie contains your name, your email, or anything you have typed. They hold a randomly generated number.

Where you are decides what happens:

• European Economic Area, United Kingdom, Switzerland — we ask you first. Until you choose, Google Analytics is not loaded at all and no cookie is set. Choose Accept and it loads. Choose Decline and it never loads, and if the two cookies above are already on your device from a visit made outside these countries, we delete them.

  How long we remember your answer. It is kept in your browser's local storage (rs_analytics_consent_v1), not in a cookie — remembering that you said no must not itself store the thing you refused. It has no expiry date of its own, so it lasts until you clear your browser's storage. Two things will make us ask again: using a different browser or a different device, since the answer is stored per browser; and Safari on iPhone, iPad or Mac, which deletes storage of this kind automatically after about 7 days without a visit. If you decline and come back a fortnight later on Safari, you will be asked once more — that is Apple's behaviour, not a second attempt on our side. Nothing is loaded in the meantime.

• Everywhere else — Google Analytics runs and sets the two cookies above. You can remove them at any time using the browser instructions in section 5, and you can stop them being set again by installing Google's opt-out add-on.

If we cannot tell which country you are in, we treat you as if you were in Europe and ask first.

4. What we do not use

We do not use:

• Cookies that follow you across other websites. We do not track you around the rest of the web. The two cookies in section 3.8 work only on our own domain.
• Cookies that hold anything you typed. Your messages, drafts, profile text and Wingman conversations never go into a cookie and are never passed to an analytics or advertising provider.
• Product-analytics cookies. We measure product usage with PostHog too, and it sets no cookies at all. Outside the EEA/UK/Switzerland it keeps one anonymous identifier in your browser's local storage (section 3.7); for EEA/UK/Switzerland visitors it keeps nothing on your device. See the privacy policy, section 5.
• Social sharing widget cookies — we don't embed share buttons from third-party social platforms.

If we introduce any further non-essential storage, we will update this policy and, where the law requires it, ask for your consent first.

5. How to control cookies and storage

You can control cookies through your browser settings. Most browsers let you:

• See and delete existing cookies
• Block cookies from specific sites
• Block all cookies

You can also clear browser local storage (where the Supabase sign-in token is stored) through your browser's settings.

Heads-up: blocking or clearing the items listed in section 3 will sign you out. The Service will not function without these essentials.

Browser-specific instructions:

• Google Chrome
• Apple Safari
• Mozilla Firefox
• Microsoft Edge

6. Changes to this policy

If we change our cookie usage — for example, by adding analytics — we will update this policy and note the new effective date at the top. Material changes will also be communicated via an in-app notice or email.

7. Contact

Questions about this policy? Email support@replysmooth.com.