Cookie Policy
Last Updated: October 4, 2026
Effective Date: July 17, 2026
1. Structure of Tracking Technology
The Trigger Tracker™ web application (operated by KATCHIMEDIA, LLC) utilizes tracking tools, including HTTP cookies and local storage tokens, to deliver a seamless, high-performance user experience. This Cookie Policy explains the technical frameworks, lifecycles, and user controls governing these tracking systems, fully designed to satisfy the EU ePrivacy Directive (2002/58/EC as amended), GDPR, and California CalOPPA frameworks.
2. Radical Commitment to Ad-Free Data Integrity
🚫 ZERO MARKETING OR BEHAVIORAL TRACKING COOKIES
The Trigger Tracker™ does NOT use advertising, targeting, behavioral profiling, or tracking cookies.
We do not integrate data brokers, tracking tools (such as Google Analytics or Meta/Facebook Pixels), or third-party advertising or analytics scripts. One narrowly scoped third-party script exists in the product: Cloudflare’s Turnstile bot-check, rendered exclusively on the sign-up and sign-in screens to prevent abusive automated account creation. It sets no cookies, stores nothing on your device, and never receives entry content or account data. We believe your mental health patterns and trigger histories are confidential. The identifiers we employ exist solely to keep you signed in and to remember your display preferences. There is no analytics or advertising technology of any kind anywhere in this application.
3. Comprehensive Inventory of Cookies & Local Storage Structures
A. Strictly Necessary Session Identifiers (Cannot Be Disabled)
| Technology Name | Technical Category | Lifespan | Core System Purpose | Data Maintained |
|---|---|---|---|---|
| sb-<project>-auth-token | First-Party Cookie (set by Supabase Auth) | Session, refreshed automatically while you remain signed in; cleared when you sign out. | Authenticates your login status on every request and scopes all database reads and writes to your own account. | Encoded session token issued by our authentication provider. |
This is the only cookie The Trigger Tracker™ sets. It exists solely to keep you signed in. Blocking it will prevent you from logging in at all.
B. Functional Preferences (Local Storage, First-Party)
The items below are stored in your browser’s local storage, not transmitted to our servers, and hold no personal or health-related information. Clearing your browser storage simply resets them to their defaults.
| Technology Name | Technical Category | Lifespan | Core System Purpose | Data Maintained |
|---|---|---|---|---|
| tt-theme | First-Party Local Storage | Until you clear browser storage. | Preserves your chosen appearance setting (Light, Dark, or Auto). | Plaintext configuration string (“light”, “dark”, or “auto”). |
| tt-evening-suggestion-dismissed | First-Party Local Storage | Until you clear browser storage. | Records that you dismissed the one-time evening-mode suggestion, so it is never shown again. | A single flag value. No timestamp, no usage history. |
| tt-cookie-notice-dismissed | First-Party Local Storage | Until you clear browser storage. | Records that you dismissed the one-time notice describing this policy, so it is never shown again. | A single flag value. No timestamp, no usage history. |
| tt-app-lock | First-Party Local Storage | Until you clear browser storage, or turn App Lock off in Settings. | Remembers that you turned on the optional App Lock for this device, and holds the credential it checks against when the app opens. | A configuration flag, the chosen method (PIN or device biometric), and a SHA-256 hash of a random salt plus your PIN. The PIN itself is never stored. |
| tt-screen-privacy | First-Party Local Storage | Until you clear browser storage, or turn Screen Privacy off in Settings. | Remembers that you turned on the optional Screen Privacy setting, which blurs entry content when this browser tab loses focus. | Plaintext configuration string (“on”). |
C. Payment Processing (Stripe)
Stripe sets its own fraud-prevention cookies during checkout, but it does so on Stripe’s own domain, not ours. The Trigger Tracker™ loads no Stripe scripts on any page: checkout is a server-side redirect to Stripe’s hosted payment page, so no Stripe cookie is ever placed on thetriggertracker.com. Once you are on Stripe’s page, Stripe’s own privacy and cookie policies apply.
D. Session Flags (Session Storage, First-Party)
The item below is stored in your browser’s session storage, not transmitted to our servers, and holds no personal or health-related information. It is discarded automatically when you close the tab.
| Technology Name | Technical Category | Lifespan | Core System Purpose | Data Maintained |
|---|---|---|---|---|
| tt-unlocked | First-Party Session Storage | Until you close the tab or window. Never persists to the next visit. | Records that you already satisfied App Lock in this tab, so the lock is not re-shown on every page while you are using the app. It returns the next time you open the app fresh. | A single flag value. No timestamp, no usage history. |
4. User Controls & Browser Adjustment Workflows
4.1 Browser Configuration Controls: You can block, disable, clear, or reject tracking tokens through your browser settings. Be advised that since our tracking dependencies relate directly to Next.js session validation and user authentication, blocking all local storage or cookie identifiers will prevent you from logging into your account or accessing the secure cloud parameters of the platform.
4.2 Disabling Workflows Across Popular Applications: For localized instruction sets on how to govern, disable, or clear storage tables, please consult the formal technical documentation provided by major browser systems (e.g., Google Chrome, Mozilla Firefox, Apple Safari, Microsoft Edge).
5. Do Not Track (DNT) Signals
While the tech ecosystem lacks a unified standard for interpretation, our infrastructure naturally aligns with the spirit of the Do Not Track (“DNT”) and Global Privacy Control (“GPC”) browser markers. Because we do not deploy tracking tools or third-party advertising or profiling scripts, our application honors your DNT signal by ensuring zero marketing transmission runs background layers.