Cookie & Storage Notice

Current optional geographic map notice

When Geoapify geographic maps are enabled, your browser requests background tiles directly from Geoapify. Those requests include the selected style, tile coordinates and zoom level, a public map-display key, your IP address, browser request information and this website's origin. The requested tiles reveal the geographic area being viewed.

VIDIK360 draws business markers, ranks and selected points locally. It does not add business names, ranking queries, prompts, account IDs, credit balances or private scan evidence to tile requests. Opening or changing the map does not run a ranking scan or spend scan credits. Geoapify map usage is separate from ranking collection.

An explicit style choice can be saved in this browser for the signed-in user. This is a display preference, not advertising tracking. Map tiles use ordinary browser caching; VIDIK360 does not add an offline tile store, a geocoder or a map-image export. Coordinate and result-list views remain available without background tiles.

Map attribution identifies Geoapify and the geographic data sources. See the Geoapify privacy policy for its processing. This technical notice describes the enabled map feature; it does not claim a signed data-processing agreement, a data residency commitment or legal approval.

This current notice supplements the map description in the staging draft below. Historical document versions and prior acknowledgements are preserved unchanged. Geographic maps remain configuration-dependent; this notice does not imply that they are enabled in every environment.

Essential authentication cookies

vidik_access holds a Supabase access token with the expiry returned by the authentication service. vidik_refresh holds the refresh token with a browser maximum age of 30 days, renewed when a new session is issued. On hosted HTTPS they are Secure, HttpOnly and SameSite=Lax. They are used to authenticate requests, not for advertising.

vidik_verifier binds an email confirmation or recovery request to the initiating browser. Its maximum age is 24 hours for signup and one hour for recovery; this does not extend the provider's confirmation-link lifetime. vidik_recovery marks a recovery flow for one hour. Sign-out clears the application authentication cookies. A local fixture preview can use vidik_fixture for up to one day; that cookie is not a hosted customer login.

Browser drafts and request keys

Local storage keys beginning vidik360:draft: and vidik360:onboarding: preserve unsaved configuration and onboarding fields. They are scoped to the account and, for configuration, the project/version. They have no automatic time limit. Saved drafts may be removed by the relevant save flow; you can clear local drafts in Privacy controls or clear the site's browser data.

Session storage keys beginning vidik360:report-email: retain request identifiers to prevent duplicate report-send requests after a retry or reload. They contain identifiers, not API credentials, and normally last until the browser tab's session ends. A pending signup acknowledgement may be retained in session storage until confirmation or cancellation.

Clearing local data does not delete saved server data, cancel a queued job or revoke an already shared report. On a shared computer, sign out and clear local drafts when finished.

Tracking and external sites

No optional browser analytics, advertising pixels or session replay were found in the reviewed application. The referral capture described below does not load a third-party tracker. No unrelated optional tracker has been added to justify a banner. Notice and any required consent controls must change before optional tracking is introduced.

Following an explicit VIDIK360 referral link can set vidik_referral_capture, a first-party random opaque token with a maximum age of thirty days. On hosted HTTPS it is Secure, HttpOnly and SameSite=Lax. The server retains a hash of the token to associate the first valid pre-signup referral with an eligible new account. The cookie contains no email, payment information or scan evidence. It is set by the referral-link flow, not by ordinary unrelated page visits; it does not track browsing across other sites.

An explicitly entered approved-promoter code is a server-side account preference. Clearing the browser referral cookie stops that unclaimed browser association; it does not erase an attribution, financial record or reward already recorded on an account. Use Privacy controls for reviewed personal-data requests. The permitted legal basis and any jurisdiction-specific consent classification for referral attribution must be reviewed before public launch.

Stripe-hosted checkout and other external destinations operate separately and may use their own cookies. Browser/provider network metadata is distinct from VIDIK360's local draft storage. The current coordinate plot makes no map-tile request.