Cookies & Local Storage

1. We Set No Cookies

Not one. No analytics cookie, no advertising cookie, no preference cookie, no session cookie. Nothing we write on your device is a cookie at all.

One honest caveat, because a blanket claim would be wrong: Google's reCAPTCHA script — which we load to keep bots off our AI budget — sets its own storage under Google's domains. That is Google's, not ours, it is a security measure, and it is described in section 2.

That is not an accident of a small product — it is a decision we made and then engineered for, and it is the reason you have never been asked to click “Accept all” here.

2. What Is Stored on Your Device

Your sign-in session — IndexedDB (strictly necessary)

When you sign in with Google, the Firebase Authentication SDK stores your session token in IndexedDB — a browser storage area, not a cookie. It exists so you stay signed in between visits instead of re-authenticating on every page load. It is never transmitted to third parties, it cannot be read by other sites, and it is strictly necessary to provide a service you asked for. Signing out clears it, and so does clearing your browser's site data.

Analytics — nothing at all

PostHog, our only analytics tool, runs in memory-only mode. It keeps a per-tab identifier in RAM and writes nothing to your device — no cookie, no localStorage entry. Close the tab and it is gone, which means there is no persistent identifier to follow you between visits. It also honors Do Not Track: with DNT enabled in your browser, we capture nothing at all. Session recording is disabled, so no replay of your screen is ever made.

Sign-in flow — short-lived sessionStorage

During pre-launch sign-up we briefly hold an invite code in sessionStorage so it survives the hop to Google and back. It is cleared as soon as the code is redeemed and disappears when you close the tab.

reCAPTCHA Enterprise — the one third-party storage surface

We use Google reCAPTCHA Enterprise through Firebase App Check to prove that requests come from our actual app rather than a script hammering our AI budget. Google's script may set its own storage in your browser under Google's domains, governed by Google's privacy policy. This is the only third-party storage on the site, it is a security measure rather than a tracking one, and reCAPTCHA data is not used by us for advertising or analytics.

3. Why There Is No Consent Banner

Consent banners exist because of rules — the EU ePrivacy Directive among them — that require permission before storing or reading information on your device for non-essential purposes. Two of those words do the work: non-essential.

• The only thing we store is your sign-in session, and it is strictly necessary to deliver a service you explicitly requested. Storage of that kind is exempt.
• Our analytics store nothing on your device, so there is nothing to ask about.
• We run no advertising, no retargeting, and no cross-site tracking of any kind.

A banner here would be theater: a dialog asking permission for something that is not happening. We would rather build the product so the honest answer is “nothing to consent to” and then publish this page so you can verify it.

4. What You Can Do

• Turn on Do Not Track in your browser and we capture no analytics from you whatsoever.
• Sign out to clear the session token, or clear site data for our domains to remove it along with everything else.
• Block third-party storage if you like — the site works; reCAPTCHA may occasionally ask more of you.

5. If This Changes

If we ever introduce something that stores non-essential data on your device, this page changes first and a consent mechanism ships with it. Questions: privacy@generativecats.app. Related reading: the Privacy Policy and Your Data & Deletion.