Cookie 政策
Cookie Policy
Last updated: 2026-07-31
This Cookie Policy explains how Supaplan uses cookies on its website only. The Supaplan mobile app does not use browser cookies.
1. What Are Cookies?
Cookies are small text files stored on your device when you visit a website.
2. Cookies We Currently Use
The Supaplan website sets two categories of cookies:
- Strictly necessary — required for the website to function (no prior consent needed under the e-Privacy Directive Article 5(3) and GDPR Recital 47).
- Analytics + support chat — Google Analytics (GA4) loads by default on production deployments, and is disabled entirely on non-production (staging) deployments. First-time visitors see a dismissible informational notice explaining that the site uses analytics — this is a notice, not a consent gate, so dismissing it does not change whether analytics runs. The only way to stop analytics is the account-level opt-out in the calendar app under Settings → Preferences, which disables GA at runtime (per-property kill switch + Google Consent Mode denial) and clears the GA cookies. That same account opt-out also controls product analytics (Mixpanel, §3). Tidio live-chat does not auto-embed; its script and cookies load on demand inside the calendar app (
/cal/*) when you open the in-app Help chat. You can also prevent cookies via your browser's tracking-protection settings or the per-vendor opt-outs in §5.
| Category | Purpose | Cookie names | Set by |
|----------|---------|--------------|--------|
| Authentication | Maintain your signed-in session and refresh access tokens | sb-* (Supabase SSR) | Supabase Auth via the Supaplan web app |
| Preferences | Remember the locale you selected for marketing pages | NEXT_LOCALE (or equivalent set by next-intl) | Supaplan web app |
| Analytics (on by default, production only) | Measure page views and aggregate site usage across the website | _ga, _ga_*, _gid | Google Analytics (GA4) via www.googletagmanager.com — loaded by default on production; stopped only by the account-level opt-out in Settings → Preferences |
| Support chat (loads on demand in /cal/*) | Tidio live-chat session and visitor identification | Tidio chat session cookies (set by code.tidio.co) | Tidio via openTidioChat() in src/utils/tidio.ts (triggered from the calendar-app Help button) |
Authentication cookies are set with HttpOnly, Secure, and SameSite attributes. They are removed when you sign out or when the session expires.
Google Analytics cookies are set by first-party JavaScript loaded from www.googletagmanager.com. Analytics data is processed by Google LLC (United States) with Google Ireland Ltd. (EU) as sub-processor, under their Privacy Policy. Cross-border transfers are covered by the EU Standard Contractual Clauses. GA4 event and user data retention in our property is set to 14 months; aggregated reports persist longer per Google's default reporting policy. You can stop Google Analytics by using the account-level analytics opt-out in the calendar app under Settings → Preferences (which disables GA at runtime and clears its cookies), by installing the Google Analytics Opt-out Browser Add-on, or by managing cookies in your browser settings (see §5).
Analytics notice: Analytics is on by default on production. A dismissible informational notice tells first-time visitors that the site uses analytics; it is not a consent gate, and dismissing it does not change whether analytics runs. To stop analytics, use the account-level opt-out in the calendar app under Settings → Preferences — this disables Google Analytics at runtime, clears its cookies, and also stops product analytics (Mixpanel, §3). Tidio's cookies still load only if you open the in-app Help chat.
3. Product Analytics (Browser Storage, Not Cookies)
When you are signed in to the Supaplan calendar app (/cal/*), we load Mixpanel to understand how the product is used. Mixpanel is configured to use localStorage for its identifiers — it does not set cookies — so this section is informational rather than a cookie disclosure.
| Tool | Purpose | Storage | Set by |
|------|---------|---------|--------|
| Mixpanel | Product analytics on the authenticated calendar app (/cal/*) — page views, onboarding events | localStorage (no cookies) | Mixpanel via the Supaplan web app, EU residency (api-eu.mixpanel.com) |
Mixpanel is not loaded on the marketing website, public booking pages (/book/*, /shared/*), or pre-authentication screens (/cal/auth*). It only initialises after you sign in, and only while the account-level analytics opt-out is off — turning on that opt-out in the calendar app under Settings → Preferences prevents Mixpanel from loading and resets its identity. (Dismissing the informational notice in §2 does not affect Mixpanel; only the account opt-out does.)
Mixpanel, Inc. is based in the United States; we rely on the EU Standard Contractual Clauses for cross-border transfers and on Mixpanel's EU residency endpoint to keep raw events in the EU. Event and People-profile data is retained for 5 years from the most recent event under Mixpanel's standard project policy; deleting your Supaplan account triggers a Mixpanel delete request for your distinct ID. The People profile Supaplan attaches to your distinct ID is enumerated in the Privacy Policy §3.1.
You can clear Mixpanel's localStorage entries at any time via your browser settings, or by signing out (which calls mixpanel.reset()).
4. Cookies We Do Not Use
We currently do not set:
- Advertising or remarketing cookies.
- Cross-site tracking pixels beyond what Google Analytics / Tidio set on their own domains.
If we add cookies in any of these categories in the future, we will update this policy.
5. Managing Cookies
You can manage cookies via your browser settings (clear, block, or limit cookies for specific sites).
- Authentication cookies — blocking these will sign you out and prevent access to the authenticated areas of the website.
- Analytics cookies — you can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on or by deleting and blocking the
_ga*and_gidcookies in your browser settings. Opting out does not affect site functionality.
6. Changes to This Policy
We may update this Cookie Policy from time to time. The latest version is always published on our website with an updated "Last updated" date.