Cookie Policy

1. Cookies, local storage and IndexedDB

A cookie is a small text file a site places on your device that your browser sends back with each request. localStorage is a browser storage area that stays on your device and is not sent to servers automatically. IndexedDB is a larger browser database, also purely local. We use all three, each for a distinct job, and we disclose the non-cookie technologies here for transparency even where the law focuses on cookies.

2. The cookies we set — complete list

Supabase authentication cookies (names beginning with "sb-") — Essential. Set when you sign in, they hold your session tokens so you stay signed in and your session stays secure. First-party; the access token is short-lived (on the order of an hour) and refreshed automatically, and the session persists until you sign out or it expires. Without them you cannot stay signed in.

"ppn-did" — Essential (device identifier). Set only after you sign in. It holds a random identifier for this browser so we can enforce the limit on how many devices one account may use at once, which is what stops a single subscription being shared across an unlimited number of people. It is first-party and httpOnly, meaning no script on the page can read it. It contains a random value and nothing else — no name, no email, no location — and it is never used for advertising or analytics. Lifetime: about 13 months. Clearing it simply causes a new one to be issued on your next sign-in.

"ppn-geo-lang" — Essential (language hint). On requests from countries with one unambiguous site language (for example France or Mexico), our edge proxy reads the country code that our hosting platform (Vercel) derives from your IP address and stores "fr" or "es" in this cookie. It is only a first-visit hint: it is consulted once, when you have no saved language preference, and your explicit choice always wins afterwards. Lifetime: 1 year. It contains a two-letter language code and nothing else; no precise location is ever computed.

"dev_bypass" — Development only. A staff-access cookie that exists only in development and preview environments where a specific server secret is configured; it plays no role in normal production use of the Service and is listed here purely for completeness.

Third-party pages you visit from the Service set their own cookies under their own policies: Stripe sets cookies on its checkout and customer-portal pages (fraud prevention and session handling), and the Cloudflare Turnstile widget embedded in our public contact form may use browser storage to verify you are not a bot. Neither runs on ordinary browsing of PPN World pages.

3. Local storage — complete list

All localStorage entries stay on your device and are never transmitted automatically: - "ui-lang" — your interface language (en, fr or es). - "ppn-theme" — your display theme. - "ppn:cookie-notice-ack" — a timestamp recording that you saw the cookie-notice banner, so it isn't shown again. - Keys prefixed "ppn-surveillance:" — the working preferences of the feed, globe and dashboard: bookmarks, watchlist, saved searches, reading history and read state, notes, panel layout and density, alert settings, draft texts and similar interface state. - A small number of panel-specific keys (dashboard layout, active team selection, onboarding checklist state). When you are signed in, the substantive items (bookmarks, watchlist, saved searches, workspaces, settings) are also synced to your account's preferences record in our database so they follow you across devices — that server-side copy is covered by the Privacy Policy.

4. IndexedDB — the local press-item cache

The Service keeps a local database named "ppn-items" in your browser's IndexedDB. It caches recently loaded press items (headlines, snippets, metadata) so the feed opens instantly on your next visit and remains readable during brief connectivity drops. It contains press content, not personal information about you, and clearing your browser's site data removes it with no lasting effect.

5. Analytics: one cookieless tool — and no advertising trackers

PPN World runs one audience-measurement tool: Vercel Web Analytics, provided by our hosting platform. It is first-party and cookieless — it sets no cookie and writes nothing to your device, so there is no stored identifier and nothing to clear. For each page view it records the page path, the referring page, and coarse technical facts: country, browser, operating system and device type. To count returning visitors within a single day it derives a one-way hash from your IP address and browser user agent combined with a secret that changes every 24 hours; your IP address itself is not stored by it, and the hash cannot be linked to you or followed from one day to the next. It builds no profile, follows you to no other website, and is never used for advertising. We load no Google Analytics, no session replay, and no advertising cookie, marketing pixel or cross-site tracker. We do not sell or "share" personal information for targeted advertising within the meaning of the CCPA/CPRA. Because this measurement stores nothing on your device, it is not the kind of technology that requires prior consent under the ePrivacy rules; if we ever introduce one that does, we will present a genuine accept/decline choice before it activates and update this policy first.

6. Requests your browser makes to third parties

Independently of cookies, some features make your browser fetch resources directly from third parties, which necessarily reveals your IP address and the requested resource to them: map basemap tiles from CARTO and, for the satellite view, Esri (ArcGIS Online); realtime updates over a direct connection to Supabase; and the Turnstile check from Cloudflare on the contact form. Country-outline files load from our own domain first, with public CDNs (jsDelivr, GitHub) as fallback only. No press-release image or script is proxied through trackers.

7. The notice banner and your controls

Because we only use essential technologies, the banner shown on your first visit is an information notice, not a consent gate: acknowledging it stores only the "ppn:cookie-notice-ack" timestamp and triggers nothing else. Your controls: clear cookies and site data in your browser settings (this signs you out — you can sign back in anytime); clear localStorage to reset local preferences and make the banner reappear; block third-party requests with browser or extension settings (map views may not render). Blocking the Supabase cookies prevents signing in; everything that works signed-out keeps working.

"Do Not Track" and "Global Privacy Control" signals: since we run no advertising or cross-site tracking and sell or share nothing, these signals have no tracking to switch off on PPN World. We state this here so their handling is explicit.

8. Legal framework, changes and contact

Bollé Communications inc. is responsible for the processing described here. Essential cookies and storage rest on the necessity of delivering the service you request (and our legitimate interest in securing it); under Québec's Law 25 the technologies above are limited to what is necessary and are disclosed here. Your rights and the complaint routes are described in the Privacy Policy. We will update this policy whenever a cookie or storage key is added, changed or removed; the "Last updated" date above identifies the version in force. Questions: ppnw@ppnsource.com.