Overview
This Policy describes the browser storage and related network requests used by the public egohero.com Service. It supplements our Privacy Policy. Separately branded sites linked from EGO HERO have their own storage practices.
1. What this Policy covers
“Cookies” here includes HTTP cookies and similar storage/access technologies such as localStorage, sessionStorage, and IndexedDB. A normal browser HTTP cache may also retain fonts, scripts, WebAssembly, workers, or images according to browser and server cache settings; it is not used by EGO HERO as a unique tracking identifier.
2. Your choices
Optional Analytics is off before you choose. Strictly necessary storage remains available because it records the choice, maintains an authentication session you request, or completes the sign-in flow. Functional and Marketing storage are not currently used; a material future use would require a new choice.
| Choice | Effect |
|---|---|
| Accept analytics / necessary only | Enables Analytics unless Global Privacy Control is active. Functional and Marketing remain off. |
| Reject optional | Leaves only Strictly Necessary storage. |
| Customise | Lets you choose Analytics. The currently unused categories cannot collect prospective consent. |
| Reset choices | Removes the consent record and shows the choice again. It does not sign you out. |
You can reopen Cookie settings from the footer. Withdrawing Analytics consent applies Google’s disable flag and denied consent state in every open tab that receives the browser’s storage-change event, stopping future GA measurement and attempting to clear our GA cookies. Browser storage controls remain the definitive way to clear all site data.
3. Current browser-storage inventory
3.1 Strictly Necessary
| Name / pattern | Type | Purpose | Lifetime |
|---|---|---|---|
egohero:consent:v1 | localStorage | Stores category choices, policy version, and decision timestamp so the banner can respect your choice. | Until you reset/clear it or a material policy-version change makes the record obsolete. |
sb-<project>-auth-token and related temporary Supabase auth entries | localStorage | Maintains the sign-in session and refresh state you request. | Until sign-out, expiry, revocation, replacement, or browser-site-data clearing. |
auth:return-to | sessionStorage | Stores a same-origin path so a callback in the same tab/session can return you to the page where sign-in began. A magic link opened in a new tab or external mail client normally falls back to the home page. | Removed after callback; otherwise until the tab/session closes. |
3.2 Functional and legacy OCR storage
No current feature writes optional persistent Functional storage. Tesseract runs with persistent caching disabled, so OCR language packs, inputs, and outputs are not read from or written to its IndexedDB adapter. At application start, EGO HERO asks the browser to delete the legacy keyval-store database created by earlier releases. That best-effort deletion can remain blocked until another open tab or worker releases the database; browser site-data controls can remove any residue.
3.3 Analytics (only with consent)
Google Analytics 4 sets first-party cookies for pseudonymous browser and session measurement. Google uses raw IP addresses at collection time for routing, coarse location, and certain basic functions, then states that it discards rather than logs the raw address. Our basic Consent Mode v2 setup keeps ad storage, ad user data, and ad personalisation denied; the tag also disables Google Signals and ad-personalisation signals. Analytics is not initialized on the authentication callback route.
| Name | Type | Purpose | Typical maximum |
|---|---|---|---|
_ga | First-party cookie | Distinguishes a browser using a pseudonymous client identifier. | Up to 2 years; use can refresh expiry. |
_ga_PLL4NY6KEH | First-party cookie | Maintains session state for EGO HERO’s GA4 property. | Up to 2 years; use can refresh expiry. |
3.4 Marketing
EGO HERO does not currently set Marketing storage, load advertising pixels, or collect prospective Marketing consent. A material future use requires a new choice.
4. Consent-independent and third-party requests
A network request does not always set a cookie. The following providers can still receive ordinary request metadata such as IP address, user agent, requested URL/asset, timestamp, and referring origin. Their own policies control any storage they set on their domains.
| Trigger | Provider | Request |
|---|---|---|
| Page display and design-catalog fonts | Google Fonts; generation rules also permit Bunny Fonts for future demos | Font stylesheets/files, including the site’s base, route-specific, and catalog-selected families. |
| Displaying a non-English page | Google Translate | Uncached visible interface text and target language. Form values, account emails, filenames, picker/output names, and files are marked not to translate. |
| Signing in | Supabase; Google if OAuth is selected | Authentication and redirect requests. Google may use cookies on its own account domain. |
| Opening or using certain browser-local tools | unpkg and jsDelivr | Static FFmpeg, PDF, SQLite, DuckDB, Tesseract worker/core/language, and related JavaScript/WebAssembly assets. Selected files are not sent to the CDN. |
| Viewing a catalog card or sandboxed demo | Current published sources include Unsplash, Picsum, Wikimedia, Pravatar, and Google Fonts; future generated demos may use another permitted source such as Bunny Fonts | Example image/font requests embedded in the catalog or generated demo. The iframe is sandboxed and configured to reduce credential sharing, but the provider still receives request metadata. |
| Analytics consent | Google Analytics / Google tag | Analytics script and measurement requests described above and in the Privacy Policy. |
The AI Background Remover uses a same-origin EGO HERO endpoint rather than third-party browser storage. Its temporary server processing is described in the Privacy Policy.
5. How to control storage
| Control | What it does |
|---|---|
| Cookie settings | Change the Analytics choice, reject optional storage, or reset the consent record from the footer. |
| Browser site-data controls | Block or delete cookies, local/session storage, IndexedDB, and cached assets. Blocking Strictly Necessary storage can break sign-in or cause the banner to reappear. |
| Global Privacy Control | While the browser reports a GPC signal, Analytics and Marketing stay off for that browser even if an older consent record says otherwise. |
| Google Analytics opt-out | Google also offers an Analytics Opt-out Browser Add-on. |
6. Changes
We update this inventory when storage or request behavior changes. A material new optional purpose requires a policy-version bump and a new choice; corrections that do not change the purpose may only update the effective date.
7. Contact
Questions about storage or consent? Email hello@egohero.com.