Cookie and Browser Storage Policy

DepthCarve uses a Secure, HttpOnly, SameSite=Lax session cookie named dc_session after successful email-code or Google sign-in. JavaScript cannot read this cookie. It links the browser to a hashed server session and expires after thirty days or when you sign out. Google OAuth and One Tap also use short-lived, HttpOnly challenge cookies to prevent forged sign-in responses.

Local storage holds a random anonymous analytics identifier, your analytics-consent choice, and the time when you dismiss or skip Google One Tap. The One Tap timestamp suppresses another automatic prompt for six hours. The analytics identifier helps count bounded funnel events without placing your source image or raw API data in analytics properties.

Google Analytics remains denied until you choose Allow analytics. If allowed, the browser loads the GA4 library and sends page and product events under Google's controls. click.pageview.click is included for site-level page measurement. Browser signals and regional consent requirements can affect operation.

Choose Essential only to keep Google Analytics storage denied. You can clear local storage and site cookies in your browser to reset the choice, then revisit the site. Blocking optional analytics does not prevent free generation or account access.

Public pages include Google AdSense code. Google may use cookies or comparable technology subject to location, consent, browser configuration, and its policies. Secure checkout loads Yito Pay and Stripe, or an explicitly enabled PayPal route, when you choose a paid offer. Those providers may use essential storage required to prevent fraud and complete payment.

DepthCarve does not receive complete card credentials. Payment-provider controls and browser settings can be used to manage their storage where available.

Use the site consent prompt, browser cookie settings, content blockers, or private browsing controls. Blocking essential session cookies prevents signed-in features, production-job approval, billing status, and API-key management from working.

For questions about a specific identifier or a privacy request, contact us with the browser, approximate time, and affected page. Do not include an API key, payment credential, or confidential image.