Cookie Policy — Figmentic|Words

1) What Are Cookies and Similar Technologies?

"Cookies" are small text files placed on your device by a website you visit. They are widely used to make sites work, work more efficiently, remember your choices, and provide reporting information. We also use other technologies that function similarly. Throughout this Policy, "cookies" refers collectively to all of the following:

• Cookies: small files stored by your browser. "Session" cookies are deleted when you close your browser; "persistent" cookies remain until they expire or you delete them. "First-party" cookies are set by Figmentic|Words; "third-party" cookies are set by another domain (for example, an analytics or security provider).
• Local storage and session storage: browser storage (part of the Web Storage API) that lets the Service keep data such as your sign-in state or preferences on your device. Firebase Authentication, for example, typically uses local storage to persist your login session.
• Pixels, tags, and beacons: tiny, often invisible images or snippets of code (for example in emails or pages) used to measure whether content was viewed or a link was clicked, frequently in connection with analytics and email engagement.
• Software development kits (SDKs) and device identifiers: code and identifiers used in app contexts that perform functions comparable to cookies.

2) Categories of Cookies We Use

We group the technologies we use into four categories. Strictly necessary cookies are always active because the Service cannot function securely without them; the remaining categories are used to improve, personalize, and measure the Service.

3) Examples of Cookies and Their Purpose

The list below provides representative examples by category. Exact names, providers, and durations may change as we update the Service and our providers update their technologies; treat the durations as typical rather than guaranteed.

• Firebase Authentication (session/login state) — Strictly Necessary — keeps you signed in and maintains your authenticated session — typically stored in browser local storage and persists until you sign out or clear storage.
• Firebase App Check / reCAPTCHA Enterprise (security token) — Strictly Necessary — verifies that requests originate from a legitimate, unmodified app instance and helps block abuse — short-lived token, typically refreshed during your session.
• CSRF / security token — Strictly Necessary — protects authenticated actions and form submissions against cross-site request forgery — session-based, cleared when the session ends.
• Theme / dark-mode preference — Preferences — remembers your light/dark appearance choice — persistent, typically up to 12 months.
• Translation / language preference — Preferences — remembers your selected Bible translation or language — persistent, typically up to 12 months.
• Google Analytics (for example, _ga) — Analytics & Performance — distinguishes users to measure aggregated usage and performance — persistent, commonly up to 24 months.
• Google Analytics property identifier (for example, _ga_<ID>) — Analytics & Performance — maintains session state for measurement — persistent, commonly up to 24 months.
• Google Tag Manager — Analytics & Performance — manages and deploys measurement tags — operates with the associated analytics technologies above.
• Mailchimp engagement pixel — Marketing — measures email opens and link clicks for our newsletters and resources — active when you open or interact with our emails.
• UTM / referral attribution parameters — Marketing — records the campaign, source, or referral that brought you to the Service — typically session-based or short-lived.

4) Third-Party Cookies

Some cookies are set by third parties that provide functionality, security, or measurement on our behalf. These providers may process data under their own privacy and cookie policies, and we encourage you to review them:

• Google and Firebase: Firebase Authentication, Firebase App Check, reCAPTCHA Enterprise, Cloud Firestore, Google Tag Manager, and Google Analytics support sign-in, security, data storage, and measurement.
• Mailchimp: supports our email and marketing communications, including engagement measurement.
• Stripe (at checkout): the Service is currently free, but if and when we introduce paid subscription tiers, Stripe may set cookies during the payment or checkout flow to process payments and help prevent fraud. Mobile in-app purchases, if offered, would be handled by the Apple App Store or Google Play under their respective terms.

Google Vertex AI (Gemini) performs the AI processing that generates summaries, themes, and reflections; this is a server-side service and does not set cookies in your browser. Some contact, feedback, and delete-account forms are powered by Formspree, which may set limited cookies necessary to submit and protect those forms.

5) How to Control or Disable Cookies

You have several ways to manage cookies and similar technologies. Note that strictly necessary cookies cannot be switched off through an in-app preference because the Service cannot operate securely without them; you can still block them at the browser level, but doing so will likely break sign-in and core functionality.

• Browser settings: most browsers let you view, block, or delete cookies and clear local and session storage. Look in your browser's privacy or site-data settings. Blocking all cookies may prevent you from signing in or using key features.
• Analytics opt-out: you can opt out of Google Analytics across sites using the Google Analytics Opt-out Browser Add-on, available from Google.
• Marketing email opt-out: you can unsubscribe from our emails at any time using the unsubscribe link in any message, which also stops associated engagement tracking for future emails.
• Device and app controls: on mobile, you can manage advertising identifiers and reset them in your device settings.

6) Do-Not-Track and Global Privacy Control

Some browsers offer a "Do-Not-Track" (DNT) signal, and some offer Global Privacy Control (GPC), a browser or extension setting that communicates an opt-out preference to sites you visit. There is no universal industry standard for how DNT should be interpreted, and our handling of these signals may evolve as standards and laws develop. Where required by applicable law, we aim to honor recognized opt-out preference signals such as GPC for the categories to which they apply. You can always exercise the controls described in Section 5 regardless of whether your browser sends such a signal.

7) Relationship to Our Privacy Policy

This Cookie Policy supplements, and should be read together with, our Privacy Policy, which describes the personal information we collect, how we use and share it, the legal bases for processing, data retention, international transfers, and your rights and choices. Where this Policy and the Privacy Policy address related topics, they are intended to be consistent; the Privacy Policy governs the broader handling of personal information.

8) Changes to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in technology, the providers we use, or applicable law. When changes are material, we will take reasonable steps to notify you, such as updating the Effective Date above or providing notice in-app or by email. Your continued use of the Service after an update signifies acceptance of the revised Policy.

Contact