Cookie policy

1. What this covers

This notice describes cookies and similar storage on www.vmyelin.ai and app.vmyelin.ai. It is part of the Privacy Policy. A choice saved on one site is stored on .vmyelin.ai so the other site can read it.

2. Your choice

Until you choose, we do not start PostHog, Vercel Web Analytics, or Vercel Speed Insights, and we do not load a partner Facebook pixel or partner head script. Essential cookies still run, because the product cannot sign you in without them.

Allow analytics to start those tools. Reject to leave them off. You can change the choice later from Cookie settings in the site footer, or the Cookie settings control in the app.

3. Essential cookies

• authjs.session-token (production name __Secure-authjs.session-token). Session. HttpOnly, SameSite=Lax, about 7 days. App only.
• myelin_aff. Affiliate attribution. HttpOnly, SameSite=Lax, 60 days.
• fr_did. Free-review device rate limit. HttpOnly, SameSite=Lax, 400 days.
• Short-lived OAuth state cookies for HubSpot, Slack, and Zoom. HttpOnly, about 10 minutes.
• myelin_onboarding_dismissed. Hides onboarding. HttpOnly, about 1 year.
• cc_onboarded. Short onboarding hint, about 5 minutes.
• sidebar_state. Whether the sidebar is open. Not HttpOnly. About 7 days.
• myelin_cookie_consent. Stores accepted or rejected. Not HttpOnly, SameSite=Lax, 180 days. This is the preference itself.

Auth.js may also set its own CSRF and callback cookies. Those names are the library defaults.

4. Analytics, after you allow them

• PostHog (ph_* cookies and local storage), proxied through /ingest to PostHog in the US. Page views and named product events. We do not send your email address on identify. Session recording, if the PostHog project turns it on, masks form inputs and elements marked as private. Autocapture is off.
• Vercel Web Analytics and Speed Insights. Vercel describes these as cookieless. We still wait for the same Allow choice.

5. Other storage and scripts

• Sentry, on the app in production, receives errors and a sample of traces. It does not receive your email. Session replay is not attached. AI prompt and completion text is not recorded on the OpenAI integration.
• Cloudflare Turnstile on sign-in and the free review. The script loads from Cloudflare and may set its own cookies. It is a bot check, not advertising.
• Stripe sets cookies on Stripe's domain during hosted checkout. We do not load Stripe.js on our own pages for checkout.
• A partner Facebook pixel and an allowlisted partner head script (which can include a tag manager) load only after you allow analytics, and only on that partner's sessions.
• The browser stores a theme flag, microphone and camera labels, and scenario-builder drafts in local storage. The login form no longer stores your email there.

6. Sale or share

We do not sell personal information. If a partner turns on a pixel or tag manager, that script can share identifiers for advertising after you allow analytics. Rejecting analytics is how you opt out of that sharing on our sites. Email jonathan@vmyelin.ai to make a Do Not Sell or Share request as well.