1. Scope
Cookies are small text records stored by a website in your browser. Similar technologies include localStorage, sessionStorage, pixels, scripts, and short-lived identifiers derived from request data. This policy applies together with our Privacy Policy, which explains how we handle account information, prompts, images, transactions, and other personal information.
2. Cookie Categories
- Necessary technologies: used for authentication, session security, language selection, abuse prevention, and remembering whether you allowed analytics. Without them, sign-in, security, or privacy choices may not work correctly.
- Optional analytics and performance technologies: used to understand traffic, acquisition, device category, page use, errors, and performance, and to produce masked heatmaps and session replays. We enable these technologies only after your affirmative consent.
3. Current Cookie and Storage Inventory
- analytics_consent and analytics_consent_version: necessary first-party DermInk cookies that remember your choice and the corresponding policy version for up to 180 days.
- NEXT_LOCALE: a first-party functional cookie that remembers your language choice.
- Authentication and security cookies: used after sign-in to maintain a session, perform security checks, and prevent unauthorized access. Names and lifetimes may change with the authentication flow.
- Google Analytics: after consent, may set first-party cookies including
_gaand_ga_<container-id>. Google currently documents a default expiration of two years. - Microsoft Clarity: after consent, may set
_clckand_clskand may use Microsoft cookies includingCLID,ANONCHK,MR,MUID, andSM. - PostHog: after consent, may use first-party cookies or localStorage to hold an anonymous or pseudonymous device identifier. Exact keys depend on the SDK and project configuration.
- DermInk browser storage: after consent, we may store initial acquisition attribution in localStorage and limited journey and authentication-return state in sessionStorage. When consent is withdrawn, we disable analytics and clear data managed by our site analytics module.
- Vercel Analytics and Speed Insights: enabled only after consent. Vercel states that Web Analytics uses no third-party cookies and creates a temporary, non-persistent session identifier from request data.
4. Analytics Providers
With your consent, we use Google Analytics and PostHog to understand page visits and product flows, Vercel Analytics and Speed Insights for aggregated traffic and performance, and Microsoft Clarity for clicks, scrolling, heatmaps, and session replay. We send Clarity a Consent V2 signal that grants analytics storage and denies advertising storage. Clarity masks inputs and sensitive content; DermInk also forces masking across sign-in, account, creation, checkout, and administration areas.
We do not intentionally send prompts, reference images, generated images, filenames, email addresses, or payment information to analytics providers. Review the Google Analytics cookie documentation, Microsoft Clarity cookie list, Vercel Analytics privacy documentation, and PostHog Privacy Policy for each provider’s practices.
5. Your Choices
On your first visit, and when the policy version changes, you can choose “Necessary only” or “Allow analytics.” Choosing necessary only does not prevent core generation, sign-in, or purchase functions. You can reopen “Privacy settings” in the footer at any time. After withdrawal, we stop future optional analytics, send a withdrawal signal to providers that support it, and clear analytics storage controlled by our site. Data already received by a provider may remain under its retention rules.
You can also inspect, delete, or block cookies through your browser. Blocking all cookies may interfere with sign-in, language, and security features. Private browsing, content blockers, and browser tracking protection may also limit analytics scripts.
6. Retention
- Consent and version cookies remain for up to 180 days; a policy-version change requests a new choice.
- Google documents a default two-year expiration for
_gaand_ga_<container-id>; browsers or configuration may shorten it. - Microsoft documents 30-day retention for Clarity session recordings and up to 9 months for click and heatmap data and labeled or favorited sessions.
- Vercel states that its Analytics visitor session identifier is discarded after 24 hours.
- Necessary authentication, security, and language cookies remain for the session or functional period and may expire at sign-out, browser close, or the configured deadline.
Providers may change names, technologies, or durations. This page reflects our current configuration and the providers’ public documentation as of the effective date.
7. Changes and Contact
We may update this policy when analytics tools, purposes, or retention practices change. If a change affects the scope of consent, we will ask you to choose again. For questions about cookies, analytics, or privacy rights, email support@dermink.org.