COOKIE, LOCAL STORAGE, ANALYTICS AND ADVERTISING TECHNOLOGY POLICY

1. Scope and key definitions

1.1. This Policy applies to technologies used for the website, registered and accountless access, private text-only AI chat, browser-local conversation history, pre-created AI Character pages and media, fixed-term cryptocurrency checkout, text-only support and reporting forms, consent management, Google Analytics 4, and advertising delivered through Aefia (the “Service”).

1.2. A “cookie” is a small data file stored in a browser. “Similar technologies” include browser local storage, session storage, pixels, tags, scripts, consent strings, browser or device identifiers, cache identifiers, and other methods that store information on or retrieve information from a browser, device, or other terminal equipment.

1.3. Rules governing storage on or access to a User's device may apply regardless of whether the information is personal data, remains only on the device, or is later transmitted. Separate data-protection rules apply where the information is personal data or is linked to personal data.

1.4. First-party technologies are set or accessed by Aefia. Third-party technologies are set or accessed by an independent provider such as Google Analytics 4 or TrafficStars. The provider's legal role depends on the specific integration, agreement, purpose, and applicable law.

• Strictly necessary: Technology genuinely essential to transmit communications, protect the requested Service, maintain an authenticated or active session, remember a privacy choice, continue a pending checkout, or provide another feature explicitly requested by the User. The category is interpreted narrowly.
• Browser-local chat history: Persistent first-party storage of private text messages and generated replies on the current browser profile so conversations remain available after reloads and later visits. It is saved by default only where legally permitted, is not synchronized to Aefia as a server archive, and can be deleted through the chat menu.
• Functional preferences: Storage used to remember an optional language, display, accessibility, layout, or interface choice selected by the User.
• Analytics: Google Analytics 4 technologies used to measure traffic, sessions, page usage, performance, errors, and aggregated engagement after the required analytics choice.
• Advertising and measurement: Technologies used for advertisement auctions, delivery, frequency control, personalization where permitted, measurement, attribution, viewability, security, and invalid-traffic prevention.
• Aefia Cookie Settings: Aefia's first-party consent interface used to explain categories, purposes, providers, durations, and choices; record acceptance, rejection, customization, and withdrawal; communicate supported consent signals; and keep optional technologies blocked until the required choice is recorded.

2. Technologies and data involved

2.1. Depending on the feature, browser, device, country, consent choice, and Service configuration, cookies and similar technologies may store or process:

• A random session, browser, consent-receipt, checkout, preference, analytics, or advertising identifier.
• IP address, country or coarse location inferred from IP, browser and operating-system information, device type, language, time zone, user-agent information, and security signals.
• Requested page, referrer, timestamp, navigation, feature interaction, errors, latency, and technical performance information.
• Age-gate status, language, display or accessibility choices, consent choices, provider choices, policy version, withdrawal status, and privacy preferences.
• Private text messages, generated replies, AI Character identifiers, conversation titles, timestamps, and local conversation settings stored only in the User's browser under aefia_chat_history_v1.
• Google Analytics client and session identifiers, page location, page title, referrer, timestamps, device and browser information, approximate geographic information, session state, and configured analytics events after analytics consent.
• Ad-zone information, advertisement category, auction and delivery data, impressions, viewability, clicks, conversions, frequency information, consent signals, and invalid-traffic or security signals after the applicable advertising choice.
• Checkout and payment-status continuity information needed to associate a pending cryptocurrency transaction or access activation with the correct browser, session, or Account.
• Consent timestamp, region, category, purpose or provider choices, TCF string where used, policy version, withdrawal status, and a pseudonymous consent-receipt identifier.

2.2. Private chat text, generated replies, conversation titles or summaries, intimate preferences, sensitive-chat classifications, email addresses, wallet addresses, transaction hashes, passwords, authentication codes, wallet secrets, seed phrases, private keys, and complete payment credentials must not be included in Google Analytics events, advertising requests, page URLs, referrers, analytics dimensions, audience segments, or conversion events.

2.3. Aefia does not persistently store ordinary User messages or generated replies in a server-side chat database, application log, reverse-proxy log, analytics platform, persistent cache, or server backup. The current message and limited browser-supplied context may be processed transiently through Service and AI-provider infrastructure to generate and deliver a reply, as explained in the Privacy Policy at /privacy.

3. Browser-local chat history

3.1. Browser-local history is designed to provide same-browser conversation continuity. It is not uploaded as a persistent Account archive, is not synchronized between devices, and is not provided to Google Analytics 4 or TrafficStars.

3.2. Device-storage exemptions must be interpreted narrowly. Aefia enables persistent local history by default only where it may lawfully be treated as storage necessary for, or explicitly requested as part of, the conversation-continuity feature. In the EEA, UK, or another jurisdiction where prior consent is required or the exemption is not sufficiently clear, persistent history must remain disabled until the User separately chooses to save chat history on that device.

3.3. Local history may contain intimate, adult, or otherwise sensitive text. Anyone with access to the same unlocked device, operating-system account, browser profile, browser synchronization service, or device backup may be able to view or recover browser data independently of Aefia. Users should not save sensitive conversations on a shared or public device.

3.4. When the User sends a new message, the browser may transmit the current message and limited selected local context temporarily through Aefia and an AI provider to generate a reply. That transient transmission does not create a persistent Aefia server archive.

3.5. Local history remains until the User deletes an individual conversation or all history through the chat menu, clears browser or site data, removes the browser profile or installed PWA, or the browser removes the storage. After local deletion, Aefia has no copy and cannot recover the conversation.

• Canonical storage key: aefia_chat_history_v1
• Storage location: First-party browser local storage in the current browser profile on the User's device.
• Default behavior: Saved by default where legally permitted; disabled until separate consent where prior consent is required.
• Persistent Aefia server chat archive: None for ordinary User messages and generated replies.
• Cross-device synchronization: Not provided by Aefia.
• Analytics and advertising use: Local chat history is not read or supplied for Google Analytics measurement, advertising selection, profiling, attribution, or audience creation.
• Human review: The Operator does not routinely access or manually review ordinary private chats. Text is available for human review only when the User voluntarily submits it through an official text form or where limited transient information is lawfully available during a specific provider, security, or legal investigation.
• User deletion: The User may delete an individual conversation or all local history through the chat menu. Aefia cannot restore the deleted data.

4. Strictly necessary and requested-function technologies

4.1. Technologies may operate without optional analytics or advertising consent only where applicable law permits because they are genuinely essential to transmit communications, secure the Service, remember a privacy choice, maintain the requested session, continue a pending checkout, or provide a functionality explicitly requested by the User.

• Session continuity: aefia_session_v1 may be used during the browser session to associate requests with the correct active session or Account, protect authentication where used, and prevent session confusion.
• Local conversation continuity: aefia_chat_history_v1 stores persistent conversation history only where that storage is lawfully exempt or separately consented to. In a prior-consent jurisdiction where the exemption is not available, persistent history must remain disabled until the User chooses to save it.
• Security and abuse prevention: Session, request, and security storage may be used to protect text forms, Accounts, infrastructure, checkout, analytics, and advertising integrations against cross-site request forgery, automated abuse, credential attacks, replay, malicious traffic, and payment manipulation.
• Consent and privacy-choice storage: aefia_cookie_consent_v2 and aefia_consent_receipt_v2 remember acceptance, rejection, customization, withdrawal, provider choices, policy version, and the pseudonymous consent-receipt reference.
• Age-gate status: aefia_age_gate_v1 remembers that the adults-only access notice was answered. It is not proof of identity or age and is never treated as permission for analytics, advertising, or another optional purpose.
• Checkout continuity: aefia_checkout_state_v1 associates a pending cryptocurrency invoice, payment-status check, or Paid Access activation with the correct browser, session, or Account.
• Temporary active-chat state: Temporary memory or session storage may hold the current conversation while the active page or chat session is open so the requested interaction can function. It is distinct from persistent local history.

6.2. 4.2. A technology is not strictly necessary merely because it is commercially useful, convenient, measures traffic, remembers optional settings, improves advertising, creates audiences, increases revenue, or makes the Service more attractive. Google Analytics 4, TrafficStars optional storage, and any other non-essential technology remain subject to applicable consent and opt-out rules.

5. Google Analytics 4

5.1. Aefia uses Google Analytics 4 with Measurement ID G-EEJTYM7NBC. In jurisdictions requiring prior analytics consent, the Google tag at https://www.googletagmanager.com/gtag/js?id=G-EEJTYM7NBC remains completely blocked until the User grants the Analytics choice.

5.2. Google Analytics is used to measure visits, sessions, traffic sources, pages and features used, device categories, approximate country, technical performance, errors, and aggregated engagement so Aefia can understand and improve Service reliability and usability.

5.3. The standard GA4 JavaScript tag may set the first-party cookies _ga and _ga_EEJTYM7NBC. _ga distinguishes browser instances, and _ga_EEJTYM7NBC preserves session state for Measurement ID G-EEJTYM7NBC. Their Google-documented default expiration is up to 2 years and may be renewed when measurement events are sent, subject to Aefia configuration, browser limits, consent withdrawal, and User deletion.

5.4. Aefia uses Basic Consent Mode in prior-consent jurisdictions: before Analytics consent, the Google tag does not load, Google Analytics requests are not sent, analytics cookies are not created or read, and no cookieless Analytics pings are intentionally transmitted.

5.5. If Analytics consent is rejected or withdrawn, Aefia stops future Google Analytics tag loading, prevents new Analytics cookies, and deletes the Aefia-domain _ga and _ga_EEJTYM7NBC where technically possible. Withdrawal applies prospectively and does not erase data that Google lawfully processed before withdrawal or that must remain for a permitted retention period.

5.6. Aefia must not send private messages, generated replies, conversation titles, intimate preferences, Account email addresses, wallet addresses, transaction hashes, or other direct or sensitive identifiers to Google Analytics. Page URLs, page titles, event names, parameters, custom dimensions, and user properties must be designed accordingly.

• Provider: Google Analytics 4
• Measurement ID: G-EEJTYM7NBC
• Google tag URL: https://www.googletagmanager.com/gtag/js?id=G-EEJTYM7NBC
• Purpose: Audience and traffic measurement, session measurement, technical performance and error analysis, aggregated feature evaluation, and improvement of Service reliability and usability.
• Legal basis: Consent where required for device storage and Google Analytics processing.
• GA4 user-level event-data retention: 14 months. Aefia must keep the live Google Analytics property configured consistently with this statement. Aggregated standard reports may remain available under Google Analytics functionality and applicable settings.
• Google Signals, User-ID, and Google Ads remarketing: Not used under this Policy version. Aefia must update the Privacy Policy, this Policy, Cookie Settings, and consent configuration before enabling any materially different Google advertising or cross-device identification feature.
• Control: Use Cookie Settings to accept, reject, or withdraw Analytics consent. Browser controls may also delete GA4 identifiers and the stored consent choice.

6. Advertising technologies and TrafficStars

6.1. The Service may display advertisements supplied through TrafficStars to support free access. Depending on the selected purposes, campaign, integration, and applicable law, TrafficStars may process online identifiers, browser and device characteristics, IP address, approximate country, page and referrer information, consent signals, ad-zone information, auction data, impressions, viewability, clicks, conversions, frequency information, and invalid-traffic or security signals.

6.2. Where advertising is enabled and the applicable privacy choice permits it, TrafficStars may deliver, secure, limit, and measure advertisements and process the advertising and device data needed for those functions, subject to applicable terms, privacy information, choices, and law.

6.3. Non-essential advertising storage and requests remain blocked until the required Advertising choice is recorded. Exact provider technologies and durations must be checked against the live integration and current privacy information.

6.4. Where personalized-advertising consent is rejected or unavailable, the Service may display contextual, limited, non-personalized, cookieless, or no advertising only to the extent supported by TrafficStars and permitted by applicable law. Rejection of one purpose is not consent to another purpose.

6.5. Advertising-related disclosures may be classified as a sale, sharing, targeted advertising, or cross-context behavioral advertising under some privacy laws. Where applicable, Users may submit the relevant opt-out through Cookie Settings, the Privacy Contact Form, or a recognized browser preference signal.

• TrafficStars privacy information: https://trafficstars.com/privacy
• TrafficStars cookie information: https://trafficstars.com/cookies
• TrafficStars role: The respective controller, joint-controller, or processor roles depend on the particular advertising processing and the applicable publisher agreement or data-processing terms.
• Advertising technology and retention: Non-essential advertising storage and requests remain blocked until the required Advertising choice is recorded. Exact provider technologies and durations must be checked against the live integration and current privacy information.
• No private-chat targeting: Private messages, generated replies, conversation titles or summaries, intimate preferences, sensitive-chat classifications, and aefia_chat_history_v1 are not read or supplied to TrafficStars for advertisement selection, profiling, attribution, or audience creation.
• Advertisement transparency: Advertisements must remain distinguishable from AI Character messages and ordinary Service Content. Suspected illegal, deceptive, malicious, or infringing advertisements may be reported at /feedback.

7. Consent, rejection, withdrawal, and browser signals

7.1. Where consent is required, it must be freely given, specific, informed, unambiguous, and expressed through a clear affirmative action. Continuing to browse, closing a notice, scrolling, passing the age gate, accepting the Terms, starting a chat, or making a payment does not constitute consent.

7.2. Aefia Cookie Settings provides equally accessible and comparably prominent controls to accept optional technologies, reject non-essential technologies, or customize choices. Rejecting non-essential technologies and later withdrawing consent must be no more difficult than accepting them.

7.3. The browser choice is stored in aefia_cookie_consent_v2 for up to 12 months unless withdrawn earlier, browser storage is cleared, or a material change requires a new choice. aefia_consent_receipt_v2 links the browser to a pseudonymous consent receipt containing the timestamp, region, policy version 2026-07-31, selected categories, provider or purpose choices, and withdrawal status. The receipt must not contain private chat text.

7.4. Aefia may retain the pseudonymous server-side consent receipt for up to 5 years only where reasonably necessary to demonstrate compliance, respond to an audit or dispute, or establish, exercise, or defend legal claims. It must be access-restricted, separated from chat history, and deleted or de-identified when no longer reasonably necessary.

7.5. Users may reopen Cookie Settings from a persistent website control to review providers, change categories, withdraw consent, or submit an applicable advertising opt-out. Withdrawal applies prospectively and must update the stored choice, supported consent signal, tag-loading behavior, and first-party cookie deletion behavior without requiring Account deletion.

7.6. A fresh choice must be requested when the consent record expires, a new optional provider or purpose is added, the use materially changes, the law or consent framework requires renewal, or the stored choice can no longer be read reliably.

• Accept all optional technologies: Activates only the Analytics, Advertising, and other optional categories and providers clearly described in the interface.
• Reject non-essential: Blocks Google Analytics and optional TrafficStars technologies while retaining only storage that is genuinely necessary or lawfully exempt for the requested Service.
• Customize: Allows separate Analytics and Advertising choices and, where supported, provider- and purpose-level choices before optional processing begins.
• Local chat-history choice: Outside prior-consent regions, local history is saved by default where legally permitted. Where prior consent is required, persistent history remains disabled until the User separately selects Save chat history on this device. Advertising or Analytics consent never enables chat history.
• Browser controls: Browser settings may block or delete cookies and local storage. Doing so may sign the User out, permanently delete local chat history, reset preferences, remove consent records, interrupt checkout, or require a new privacy choice.
• Global Privacy Control: Where legally required and technically supported, a recognized opt-out preference signal such as Global Privacy Control is treated as an opt-out for the relevant browser or device.
• Do Not Track: A non-standardized Do Not Track signal may not communicate a legally enforceable or technically interoperable choice.

8. Current technology and provider inventory

8.1. The following inventory describes the current intended Service configuration:

8.2. The standard GA4 cookies for the current Measurement ID are _ga and _ga_EEJTYM7NBC. Aefia must update this Policy if live browser inspection shows an additional Google cookie, custom prefix, different duration, Google Ads-linked cookie, or materially different configuration.

8.3. Google Signals, User-ID, Google Ads remarketing, Google advertising personalization, and additional Google advertising cookies are not authorized under this Policy version.

8.4. TrafficStars and another provider may change cookie names, purposes, or durations. Aefia must compare the live browser behavior, provider documentation, consent signal, and this inventory before initial deployment and after a material provider change.

8.5. Listing a provider does not authorize activation before the applicable choice. The live tag loader, Cookie Settings, consent record, TCF signal, and provider integration must enforce the User's recorded selection.

9. Retention, accountability, updates, and contact

9.1. Browser cookies and storage remain until the stated expiration, the User deletes them, the browser removes them, the Service replaces them, consent withdrawal triggers deletion where technically possible, or the relevant provider deletes them. Some identifiers have a rolling expiration renewed by later activity.

9.2. Pseudonymous server-side records of consent, rejection, customization, withdrawal, provider choices, policy version, and consent receipts may be retained for up to 5 years only where reasonably necessary to demonstrate compliance, respond to an audit or dispute, or establish, exercise, or defend legal claims. These records must not contain private chat messages or locally stored conversation history.

• Local chat retention: Conversation history remains only in the current browser until the User deletes it or browser/site storage is cleared. Aefia has no persistent server-side copy and cannot retrieve, reconstruct, or restore locally deleted history.
• Google Analytics retention: GA4 cookies follow the durations in the inventory. Aefia configures user-level GA4 event-data retention to 14 months and must review the live property whenever the analytics configuration changes.
• Consent-record minimization: Consent evidence must contain only what is needed to demonstrate the choice, such as receipt ID, timestamp, region, policy version, categories, purposes, providers, and withdrawal status. It must not contain private chat text.
• Changes to this Policy: Aefia may update this Policy when technologies, storage keys, providers, purposes, durations, analytics configuration, consent frameworks, local-history behavior, legal requirements, or Service features change. The current version and date will be published at /cookies.
• Material technology changes: A new optional provider, materially different purpose, new analytics product, Google advertising feature, or new use of local chat history must not be activated until the required disclosure and valid choice are available. A fresh choice will be requested where required.
• Proof and audit: Aefia may review records reasonably necessary to demonstrate consent or rejection and may audit the provider list, Google tag, Basic Consent Mode, tag-loading behavior, TCF signal, browser storage, cookie deletion behavior, and policy accuracy.
• Privacy rights: The Privacy Policy at /privacy explains rights relating to personal data generated through cookies, local storage, Google Analytics, advertising, consent records, and cryptocurrency checkout.
• Cookie Settings: Use the persistent Cookie Settings control to review and change Google Analytics and advertising choices.
• Chat-history deletion: Use the chat menu to delete an individual conversation or all locally stored Aefia chat history from the current browser profile. Aefia cannot restore it.
• Questions and complaints: Use the Privacy Contact Form at /privacy for cookie, local-storage, analytics, advertising, consent, opt-out, or privacy questions. Use /feedback for general technical support and /feedback for suspected illegal or malicious advertisements.
• Related documents: This Policy should be read together with the Privacy Policy at /privacy, Terms of Service at /terms, Acceptable Use Policy at /acceptable-use, Cryptocurrency Payments Policy at /payments-refunds, Copyright and Illegal Content Policy at /copyright, and AI Content and 2257 Compliance Statement at /2257.