Cookie & Tracking Notice

DRAFT — REQUIRES REVIEW BY QUALIFIED COUNSEL IN [JURISDICTION] BEFORE USE. Not legal advice. Not a substitute for a lawyer.

Version: 1.0.0-draft · Status: not in force · Baseline: GDPR-grade

---

What we set

Cookie	Purpose	Type	Lifetime
sb-*-auth-token	Keeps you signed in	Strictly necessary	Session, refreshed

That is the whole list. We set no analytics cookie, no advertising cookie, and nothing that remembers a cookie choice — because there is nothing optional to choose. We do not share data with advertising networks.

If we ever set an optional cookie

We would say so here before setting it, not after. It would be off until you turned it on: a banner offering "Accept" and "Reject" as equally prominent choices, no pre-ticked box, no cookie wall, rejecting one click exactly like accepting. You could change your choice at any time from the footer, and withdrawing would be as easy as giving.

Strictly necessary cookies are set without consent because the service cannot function without them. We do not classify anything as necessary that is merely convenient for us.

The badge on your site

When a visitor loads a page displaying a "Verified by VibefyCode" badge, their browser requests the badge image from our servers. That request carries the visitor's IP address, user agent and the referring origin. We use it for one purpose: detecting badges displayed on a domain other than the certified one, which is how forgery is caught. It sets no cookie, builds no profile, and is not used for analytics or advertising. Retention follows the badge-telemetry entry in the Privacy Policy.

If you display the badge, you should mention this in your own cookie or privacy notice.