Cookie & Tracking Policy
- Current operator:
- Retractability Bicycles LLC
- Principal location:
- Glendale, Arizona, United States
- Contact:
- support@splittai.app
- Effective date:
- October 22, 2026
- Last updated:
- October 22, 2026
This Cookie & Tracking Policy explains how Retractability Bicycles LLC, operating the Splitt service, uses cookies, local storage, session storage, analytics technologies, and similar browser mechanisms.
This Policy should be read with the Splitt Privacy Policy.
1. What these technologies are
Cookies are small text files stored by a browser. Local storage and session storage are browser mechanisms that can store information without using cookies. Similar technologies may include request-derived identifiers, pixels, scripts, and server-side event records.
Not every technology listed here is active on every page or for every user.
2. Categories we use
2.1 Strictly necessary authentication and security
These technologies are required to:
- sign users in;
- maintain authenticated sessions;
- complete email-verification and password-recovery flows;
- protect against cross-site request forgery and session abuse;
- enforce host and origin boundaries;
- remember short-lived authentication flow state;
- prevent fraud and unauthorized access.
Examples may include host-isolated Supabase or Splitt session cookies and short-lived flow cookies.
These technologies cannot be disabled through optional analytics controls because the Service may not function securely without them.
2.2 Functional preferences and workspace state
These technologies remember user-requested settings, such as:
- light or dark theme;
- motion preference;
- contextual tips preference;
- development-notice dismissal;
- conversation sidebar state;
- Focus Belt state and position;
- local workspace pane sizes;
- drafts and pending messages;
- selected conversation or context;
- local privacy choices.
Some preferences may be stored in the user’s account and others in the browser.
2.3 Optional first-party product analytics
When allowed by your privacy choice and current configuration, Splitt may collect allowlisted, privacy-conscious interaction events, such as:
- page or feature views;
- semantic control use;
- onboarding and activation stages;
- aggregate click or section-engagement information;
- device and viewport categories;
- performance and sanitized error categories.
Splitt does not intentionally include passwords, prompts, responses, document content, filenames, form values, company names, financial amounts, raw DOM content, or keystrokes in analytics payloads.
2.4 Vercel Web Analytics
The Splitt marketing site may use Vercel Web Analytics when enabled and permitted by Splitt’s privacy controls.
Vercel describes Web Analytics as cookie-free and based on aggregated information and a request-derived visitor hash that resets daily. Depending on configuration, Vercel may process page path, referrer, timestamp, approximate location, device type, operating system, and browser information.
Splitt uses route allowlists and redaction controls to avoid sending sensitive query parameters or private routes.
2.5 Development and announcement notices
Splitt may store a local dismissal record for a development notice or announcement so that the same notice does not repeatedly appear.
Authenticated announcements may also use account-linked receipt records.
3. What we do not use
Splitt does not currently use:
- third-party advertising cookies;
- cross-site behavioral advertising trackers;
- session replay;
- keystroke logging;
- raw DOM capture;
- persistent precise cursor tracking;
- fingerprinting designed to track users across unrelated sites;
- customer business content for advertising.
If this changes, we will update this Policy and implement any required choices before collection begins.
4. Your choices
Where available, Splitt’s privacy controls allow you to:
- allow optional analytics;
- reject optional analytics;
- change your choice later.
Rejecting optional analytics does not disable strictly necessary authentication, security, or core functional storage.
Withdrawal applies prospectively and does not necessarily delete completed business records, security logs, audit records, or previously aggregated data that no longer reasonably identifies you.
5. Global Privacy Control and Do Not Track
Splitt’s current privacy-control design treats Global Privacy Control and Do Not Track signals as a request to disable optional browser analytics.
Necessary authentication, security, and functional storage may continue.
Because browser signals and legal requirements may evolve, we may update this behavior and the Policy together.
6. Optional analytics controls
The Privacy choices control lets you allow or reject optional analytics and change your preference later. We use necessary storage to keep Splitt secure and working. With your permission, we also use privacy-conscious analytics to understand which parts of Splitt are useful. We do not sell your personal information or use your business content for advertising.
These controls provide:
- no preselected choice;
- no tracking before the applicable choice is recorded;
- equal access to accept and reject;
- choice can be changed later;
- optional analytics refusal does not block signup or the Service;
- GPC/DNT overrides optional analytics to off;
- no dark-pattern color or button hierarchy;
- no legal pages or private routes tracked;
- no raw form or business content collected.
7. Source-verified storage inventory — deployment confirmation pending
| Family | Type / purpose | Local implementation duration | Choice / provider |
|---|---|---|---|
| Account/session cookies | First-party necessary authentication and security | Session and provider expiry; production settings require confirmation | Necessary; Splitt and Supabase |
| Workspace session cookie | First-party, host-isolated session | Up to 30 days, subject to server revocation | Necessary; Splitt |
| Short-lived account/OAuth flow cookie | First-party flow binding | 300 seconds; removed when consumed | Necessary; Splitt |
| Theme, motion, layout, sidebar and Focus Belt preferences | First-party local/session storage and account preferences | Until cleared/replaced or the applicable session ends | User-requested preferences; Splitt |
| Draft and pending messages | Functional application/session state, not tracking | Pending handoffs consumed; other persistence depends on the feature/session | Functional; Splitt; never analytics content |
| Development notice dismissal / announcement receipts | Local storage / authenticated server records | Notice-version state until cleared; server receipt retention needs approval | Functional; Splitt |
| `splitt:browser-privacy:v1` | Local storage, optional analytics choice | Up to 180 days before renewed choice | Explicit opt-in; withdrawal/GPC/DNT keep optional collection off |
| `splitt:insights:*` | Session storage, coarse optional interaction identifier | 30-minute validity; cleared on withdrawal | Optional first-party analytics; Splitt |
| Vercel Web Analytics | Optional SDK, not an authentication cookie | Provider processing/retention requires account-specific confirmation | Permission and route gated; Vercel |
Legal pages are excluded from optional marketing analytics even when a choice allows analytics elsewhere. Account security, audit, usage and completed authoritative actions are separate server records, not browser tracking cookies. Their retention is described in the Privacy Policy matrix. This source inspection is not independent certification of hosted behavior; deployment-specific settings remain under review.
8. Contact
Questions about cookies, tracking, or privacy choices may be sent to support@splittai.app with the subject line “Splitt Privacy Request — Tracking.”
Splitt is a product operated by Retractability Bicycles LLC.
Contact support@splittai.app. For privacy requests, use the subject “Splitt Privacy Request”. Do not send passwords or authentication tokens.