Privacy choices and storage

The web app uses host-local storage for sign-in, onboarding, language and theme preferences, and learning progress. The native app uses secure storage and an offline database for equivalent functions. These are needed to deliver requested features and remain available when optional Diagnostics is rejected.

merakuest_consent is a first-party, client-readable cookie containing only schema version, the Diagnostics choice, and decision time. On Merakuest production domains it is shared between the public site and app, uses Secure, SameSite=Lax, and Path=/ attributes, and expires after at most 180 days. It never contains an authentication token or user/device identifier.

If allowed, the Flutter web app can keep two bounded local logs: merakuest_debug_log (up to 80 lines of app/screen context) and merakuest_js_errors (up to 50 JavaScript error lines). They have no time-based expiry in current source. Rejecting or withdrawing removes them when the app origin next applies the choice and blocks future writes. This Diagnostics choice does not enable product analytics.

Analytics remains off until separately allowed and until the release has valid PostHog configuration. When both conditions are met, the app sends allow-listed custom product events to PostHog EU Cloud with platform, locale, app version, build SHA, and an opaque account UUID after sign-in. Session replay, autocapture, error capture, advertising, and personalization are disabled. Withdrawing Analytics disables collection and resets the analytics identity.

Merakuest uses its Railway-hosted API and Supabase-hosted PostgreSQL database for accounts and learning progress. Supabase Auth is not used. ArcGIS supplies requested map tiles, Cloudflare R2 can supply learning media, Resend delivers requested password-reset email, and server-side VoiceRSS may process text for requested Bulgarian speech. Google and OpenAI text-to-speech are disabled for the current beta configuration.

The audited source contains no Google Analytics, GTM, Vercel Analytics, Firebase Analytics, Sentry, advertising pixel/SDK, session replay, attribution SDK, advertising identifier, or automatic native analytics tracker. PostHog is limited to the consent-gated custom event path described above. Dormant backend payment/activity-log architecture is not described as active collection.