Legal
Cookie Policy
Last updated: September 2026
1. What are cookies?
Cookies are small text files placed on your device when you visit a website. They help us remember your preferences, keep you signed in, and understand how the site is used so we can improve it. We keep cookie use to a minimum.
2. Cookies we use
Strictly necessary cookies are always active. No optional cookie is set until you accept it in the consent banner.
| Name | Provider | Category | Duration | Purpose |
|---|---|---|---|---|
| __dpl | Lovable (hosting) | Strictly necessary | 24 hours | Deployment routing and secure delivery of the correct version of the site. |
| __cf_bm | Cloudflare | Strictly necessary | 30 minutes | Bot management and protection against automated abuse. |
| session-id | Lovable (hosting analytics) | Analytics | 30 minutes | Aggregated, first-party page-view statistics for the site owner. Set by the hosting platform; no advertising use. |
| __stripe_mid | Stripe | Strictly necessary (fraud prevention, checkout only) | 1 year | Fraud detection during payment. Loaded only when you open checkout. |
| __stripe_sid | Stripe | Strictly necessary (fraud prevention, checkout only) | 30 minutes | Fraud detection during payment. Loaded only when you open checkout. |
| m | Stripe (m.stripe.com) | Strictly necessary (fraud prevention, checkout only) | 1 year | Stripe device identification for fraud prevention. Loaded only when you open checkout. |
Your settings — backdrop scene, volume, language, dismissed prompts, tour progress, and your cookie choice itself — are kept in your browser's local storage, not in cookies, and never leave your device except your language and backdrop when you are signed in and choose to save them to your account.
3. Third-party services and data destinations
- Lovable Cloud (Supabase) — sign-in, member data and private photo storage. Your session is kept in local storage on your device; data is processed in the EU/US under Supabase's data processing terms.
- Stripe — payments. Stripe.js and its fraud-prevention cookies are loaded only when you open checkout. Stripe classifies these as necessary for fraud prevention and processes data in the US/EU under its privacy policy.
- Cloudflare — network delivery and bot protection for the site (strictly necessary).
- Google Fonts — the site's typefaces are fetched from Google's font servers, which receive your IP address. No cookie is set.
- We run no advertising networks and no cross-site tracking, and we do not sell personal data.
4. Managing and withdrawing consent
Use the consent banner to accept or reject optional cookies with equal ease. You can change or withdraw your choice at any time via Cookie Settings in the footer of every page:
You can also clear or block cookies through your browser settings. Blocking strictly necessary cookies may prevent sign-in, checkout and member features from working.
5. Contact
Questions about this policy? Write to privacy@immunityofnegativity.com or visit our contact page.