Cookie notice
Browser storage and measurement on Copycat UI.
Effective date: 17 September 2026
1. What this notice covers
Cookies are small browser files. Web apps can also use local storage, IndexedDB, tokens, and similar technologies. This notice explains the technologies confirmed in the Copycat UI repository and should be read with the Privacy Notice.
2. Technologies currently implemented
| Service | Purpose | Storage and duration | Category |
|---|---|---|---|
| Google Ads measurement | With separate permission, measures whether advertising leads to a server-confirmed paid subscription. Google receives the ZAR amount and unique checkout reference, together with browser, network, and advertising attribution signals. | Disabled until you allow Google Ads measurement. Google may use _gcl_ advertising cookies. A local copycat.ads.paid.<reference> marker prevents repeat conversion submissions and remains until browser site data is cleared. | Advertising measurement / optional |
| Firebase Authentication | Keeps you signed in, restores the authenticated session, and supports account security. | Firebase may use IndexedDB, local storage, or similar browser storage. Exact keys and duration depend on the Firebase SDK and session state. | Necessary |
| Firebase App Check / reCAPTCHA Enterprise | Assesses whether requests come from the genuine app and helps prevent abuse of Firebase and email endpoints. | Google may use cookies, tokens, device/browser signals, and similar storage. Tokens refresh automatically when App Check is configured. | Security / necessary when enabled |
| Google Analytics for Firebase | When allowed, measures visits, sessions, approximate location, browser/device characteristics, and activity so product usage can be understood. | Disabled by default and not loaded until you allow Analytics. When allowed, GA4 may use _ga and _ga_<container-id> first-party cookies; Google documents a default expiry of up to two years, subject to browser limits and configuration. | Analytics / optional |
3. Consent-controlled Analytics
Google Analytics is disabled by default and its browser module is not loaded unless you select “Allow Analytics”. When allowed, Google documents that its default web implementation collects session statistics, approximate geolocation, browser/device information, and activity, and may place first-party GA4 cookies. Google Ads measurement has a separate, default-off choice; allowing Analytics alone does not enable it.
4. Your choices
The cookie-preferences control lets you choose Analytics and Google Ads measurement separately, reject all optional tracking, and change those choices later. Each choice is stored only in this browser. If the choice is missing or cleared, Analytics remains off until you allow it again. Rejecting Analytics does not affect authentication, projects, strings, translations, billing, or other core application features.
Essential authentication and security storage is always active because it is needed to provide and protect the service. Blocking all browser storage in browser settings may prevent sign-in persistence, App Check, or secured features from working.
5. Optional advertising measurement
With your separate permission, Google Ads measures successful paid subscriptions after Paystack verification. The conversion contains the paid amount, ZAR currency, and unique checkout reference. We do not send names, email addresses, or card details in this conversion payload. Ad personalization and enhanced conversions are disabled in this implementation. Withdrawing permission stops future conversion submissions and requests deletion of accessible first-party advertising cookies; it does not undo data already sent to Google.
6. Changes and contact
Cookie names and durations can change when vendors or settings change. We will update the effective date after a material change. Questions and privacy choices can be sent to support@copycatui.com.
7. Review status
A separate Cookie Notice is warranted because Analytics and reCAPTCHA/App Check are materially different from account and workspace data processing. A separate acceptable-use page is not yet needed; the current rules are included in the Terms.