Cookie Policy

A cookie is a small file a website saves in your browser. Websites can also use local storage, which is kept until it is deleted, and session storage, which is cleared when you close the tab. This policy covers all three.

We use two kinds:

• Essential items, which the service needs to work or which only remember a choice you made. These are always on.
• Analytics items, which we use only if you choose Accept all.

We use no advertising or social media cookies.

The first time you visit, a banner offers Essential only and Accept all, side by side and in the same style. Each takes one click, so refusing is as easy as accepting. Nothing optional is set before you choose. If you ignore the banner, analytics stays off.

Your choice is saved in that browser for 12 months. After that, the banner asks you again.

Your browser downloads our analytics code with the rest of the site. It stays switched off, and it sends and stores nothing unless you choose Accept all.

PECR (regulation 6) allows these without your consent. They are strictly necessary to provide the service you ask for, or they only remember a choice you made. All are first-party: they are set on our own website and are not used to track you across other sites.

Cookies

• sb-[project]-auth-token (may be split into parts ending .0, .1 and so on). Set by us through Supabase Auth, our sign-in provider, when you sign in. Keeps you signed in. It holds your sign-in tokens and basic account details, including your email address. Deleted when you sign out, or when we sign you out after 60 minutes without activity. Otherwise your browser may keep it for up to 400 days.
• sb-[project]-auth-token-code-verifier. Set by us through Supabase Auth when you sign up, ask for a new confirmation email or reset your password. Checks that the link we email you opens in the browser that asked for it. Deleted when you use the link. If you never use it, your browser may keep it for up to 400 days.
• last_activity. Set by us on each page you load in the signed-in app. Records the time of your last request so we can sign you out after 60 minutes without activity. Expires 24 hours after your last request, and is removed once you are signed out.
• cookie_consent. Set by us when you click a banner button. Stores "accepted" or "rejected" so we know your choice. Lasts 12 months.
• sidebar_state. Set by us only when you open or close the sidebar in the app. Remembers whether it was open. Lasts 7 days.

Browser storage

• theme, projects.view, onboarding_dismissed_v2 and constructos.estimate-chat-panel-open (local storage). Set by us only when you use the light/dark switch in the app, switch your projects between list and grid view, dismiss the Getting started checklist, or open or close the AI Assistant panel. Each remembers that choice. Kept until you clear them.
• signup_email and signup_next (session storage). Set by us when you sign up, so that Resend confirmation email works without putting your email address in the web address. Cleared when you close the tab.
• gen-summary:[quote id] and pending-kicks:[quote id] (session storage). Set by us to carry a quote's generation summary, or the progress of a drawing conversion, to the next screen. Removed once used, or when you close the tab.

The preference items (sidebar_state, theme, projects.view, onboarding_dismissed_v2 and constructos.estimate-chat-panel-open) only remember your choice and hold no personal data.

Analytics shows us which features are used and where things go wrong, so we can improve the service. We use it only with your consent, which you can withdraw at any time (see Changing your mind below). It records the pages you view and a short list of actions, such as creating a project, generating a quote or downloading an export. It is tied to a random device ID, not to your name or email address.

PostHog (product analytics, with the data stored in PostHog EU Cloud). Its software sets these on our domain:

• ph_[project key]_posthog (cookie): a random device ID, a visit ID, the first page you viewed and the site that referred you. Lasts 12 months and may also apply to our subdomains.
• ph_[project key]_posthog (local storage): the same IDs, any campaign (UTM) tags in the link you followed, and PostHog settings. No expiry; deleted if you withdraw consent.
• ph_[project key]_posthog, ph_[project key]_window_id and ph_[project key]_primary_window_exists (session storage): track the current visit and browser window. Cleared when you close the tab.
• __ph_opt_in_out_[project key] (local storage): written only if you withdraw consent while PostHog is running, or accept again after that. Records your choice so PostHog respects it. No expiry.
• __mplssupport__ (local storage) and __support__ (session storage): test entries that check your browser supports storage. Deleted at once.

If we turn on session recordings, all on-screen text and everything you type are masked, and images (plans, photos, signatures) are left out.

Vercel Web Analytics counts page views by page address. Its script is served from our own domain. Vercel says it does not use cookies.

Before page addresses are sent to PostHog or Vercel, we replace the secret part of any invitation or quotation link with a placeholder.

A client who opens a builder's quotation link (an address starting /o/) sees no banner, because nothing optional runs there. PostHog does not start on that page, no analytics data is sent from it, and we store nothing on the client's device.

When a client downloads, accepts or declines a quotation, opens a contract the builder has shared, or sends a message, our server records that event in PostHog against the builder's account. This uses no cookies or device storage and does not identify the client.

You can change or withdraw your consent at any time:

• Click Cookie settings at the foot of our home page, our sign-in and sign-up pages and these legal pages, or at the bottom of the app's sidebar. The banner opens again so you can choose.
• If you are signed in, go to Settings → Privacy and, under Turn off usage statistics, switch on Restrict processing of my data. Analytics then stays off whenever you are signed in to that account, whatever your cookie choice.
• Block or delete cookies and site data in your browser settings. If you block essential cookies, you will not be able to sign in.

When you choose Essential only, we switch analytics off and delete PostHog's cookie and local-storage entries. Its session-storage entries clear when you close the tab. PostHog may keep a small opt-out record in local storage so your refusal is remembered. Withdrawing consent does not delete analytics already collected; see our Privacy Policy for your rights over that data.

• PostHog provides our product analytics, acting on our instructions, and stores the data in its EU Cloud.
• Vercel, Inc. hosts the service and provides Vercel Web Analytics. It is a US company, so data may be processed in the USA, with the safeguards described in our Privacy Policy.
• Supabase runs our sign-in and holds that data in the EU (Frankfurt).

Each publishes its own privacy policy on its website. Our Privacy Policy lists the other providers we use.

If the cookies we use change, we will update this policy and the date at the top. We will ask for your consent before using any new optional cookie or similar storage.

Questions: email contact@gromatik.ai.

If you have a concern about how we use cookies, please contact us first. We acknowledge complaints within 30 days and respond without undue delay. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk/make-a-complaint or on 0303 123 1113.