Cookie Policy

Required for: authentication (Supabase token), session persistence, CSRF security, load balancing, language preferences (it/en), beginner/pro mode, disclaimer acknowledgment and legal versioning. They do NOT require consent under art. 122 of the Italian Privacy Code. Disabling them prevents login and Service use.

Examples: sb-access-token, sb-refresh-token, ttb_legal_ack, lang, ui_mode, theme.

Store non-essential choices that improve UX: watchlist layout, market mode, column order, last page visited, notification preferences. They can be disabled from browser settings; some use localStorage, which is not revocable without manual deletion.

If enabled, we use privacy-friendly solutions with no individual profiling, no cross-site tracking, regionally-anonymized IP and no fingerprinting (e.g. Plausible Analytics, EU-hosted). Under Italian DPA Guidelines of 10 June 2021 they are treated as technical cookies and do NOT require explicit consent. They are not used for behavioural advertising.

If we activate specific advertising tools, we may set third-party cookies and pixels to measure campaign effectiveness and show you relevant ads on external platforms. Such Tools — including Meta Pixel (Facebook/Instagram), Google Ads/Conversion, LinkedIn Insight Tag, TikTok Pixel — are activated ONLY after your explicit consent via the cookie banner. You may WITHDRAW consent at any time from the cookie preferences at the page footer, with immediate effect going forward.

• Stripe: anti-fraud and 3D-Secure on the checkout page. Strictly necessary to process payment.
• Cloudflare: bot-management, anti-DDoS, performance. Strictly necessary.
• YouTube / Vimeo (only if we embed videos): may set cookies on play. We use "privacy-enhanced mode" where available.
• Telegram: coach access happens off-site on Telegram; their privacy/cookie policy applies.

For third-party policies see directly: stripe.com/privacy, cloudflare.com/privacypolicy, policies.google.com, telegram.org/privacy.

• Session cookies: browser session.
• Supabase authentication cookies: 1 hour (access) + 30 days (refresh rotation).
• User preferences (language, theme, mode): 12 months.
• Legal-acknowledgment audit: 24 months (localStorage).
• Anonymized analytics cookies: 12 months.
• Marketing cookies (only if consented): max 13 months renewable.

You can manage preferences at any time from the "Cookie preferences" link in the site footer, or delete/block cookies from browser settings (Chrome, Safari, Firefox, Edge). Blocking technical cookies prevents the Service from working (login, security). To delete localStorage/sessionStorage you must clear browser cache. For global opt-out from third-party advertising cookies you may use: youronlinechoices.com (EU), aboutads.info (USA), networkadvertising.org.

Some third-party Tools (Cloudflare, Stripe, Google, Meta) may transfer data to the United States or other third countries. Transfers rely on Standard Contractual Clauses 2021/914 and, where applicable, the EU-US Data Privacy Framework. Legal basis: legitimate interest for technical cookies, consent (GDPR art. 6.1.a and Italian Privacy Code art. 122) for non-essential ones.

We will update this Cookie Policy when new Tools are introduced or providers change. Material changes will be notified via banner and/or email. Historical versions may be requested at privacy@whalegpt.io.