Cookie Notice

This review draft describes browser storage and the optional analytics design in Kalrova. It remains pending publication review together with the Privacy Policy.

1. Why the service uses browser storage

Cookies are small values sent with web requests. Local storage stays in your browser until removed by you, the application or browser policy. Kalrova uses both for sign-in, language, account setup and writing continuity. Local storage is not automatically anonymous or exempt from privacy requirements merely because it is not a cookie.

2. Sign-in and account setup

The anp_at cookie authenticates requests and is not readable by ordinary page JavaScript. Its expiry follows the configured access-session lifetime. The anp_session cookie identifies the sign-in session this browser holds, so the service can renew that session instead of opening a new one. It contains no password, cannot authenticate a request by itself, is not readable by ordinary page JavaScript, is sent only to this site and lasts up to 90 days. The server-side record of a signed-in browser expires after 30 days without use and is replaced by a new record no later than 90 days after it was created. The publication review must confirm this description of session records and of signing out. Supabase also maintains authentication session data needed to sign you in and renew access. Signing out removes the product session cookies from this browser and ends your account's sign-in sessions on your other devices too; a device that is already open keeps its current access only until that access expires.

During invited signup, anp_invite and the anp_invite_code local-storage entry carry the invite code. The anp_legal cookie and anp_legal_consent local-storage entry carry the versions of the legal documents and the age declaration supplied at signup. The legal hint cookie can last up to 30 days. These hints do not replace server-side validation and acceptance records. Public signup does not require an invitation when that mode is enabled.

3. Preferences and writing continuity

The anp_ui_locale cookie remembers an explicit language preference; anp_ui_locale_suggested remembers a dismissed language suggestion. Their lifetimes are set by the application and are separate from authentication. The anp_cookie_notice local-storage value remembers which notice you dismissed.

Other local preferences support interface layout, navigation and editing. Recovery storage may include actual chapter draft text. Server account deletion does not erase every browser's local storage or copies you downloaded. On a shared device, sign out and clear site data when appropriate; save or export work first because clearing storage can remove unsynced drafts.

4. Optional analytics

Analytics is off by default. Analytics preferences lets you enable or reject it and later withdraw. The browser stores that choice so it can honor it. Enabling analytics turns on two things:

• First-party workspace counts. Requests contain only a fixed workspace event name and consent information. The server combines them into daily event counts retained for 90 days. It does not store manuscript content, project IDs or a browsing history in that store.
• Google Analytics. The browser loads Google's gtag.js and sends page views to Google Analytics 4. Google sets its own analytics cookies on this site, which hold a random visitor identifier and last up to two years. Page addresses are reduced to the route pattern (for example /read/[slug]) before sending, so book titles, project and chapter IDs, share links, pen names, search terms and page titles are not sent. Only the origin of an external referring site is sent. Google signals and ad personalization are turned off and no advertising cookie is set. Google also receives your IP address and browser information when it handles the request, under its own terms.

Withdrawing stops both, and the application deletes the Google Analytics cookies it can reach.

Do Not Track and Global Privacy Control prevent optional analytics even if an earlier choice enabled it. A disabled choice is not a condition of service. Choices are browser-specific. Essential authentication, security and billing records continue to operate. See the Privacy Policy for this distinction and your rights.

5. Third-party services and controls

Payment, identity-verification and external publishing or research destinations may use their own cookies or storage when you visit them. Their notices apply to those visits. This notice does not claim control over a third-party website.

Your browser can block or clear cookies and site storage. Blocking authentication storage can prevent sign-in; clearing recovery storage can remove unsaved work. You can change optional analytics without clearing essential storage through the product's Analytics preferences controls.