Privacy and control
Cookie policy and preferences
This policy explains the cookies, browser storage, and similar technologies used by Chudoly services. Necessary technologies support account security, abuse prevention, and your privacy choices. Optional technologies remain off until you choose them.
Chudoly offers an optional Google Maps Adventure Map as a Functional technology. Chudoly does not currently use optional analytics, advertising, behavioral profiling, cross-site tracking, session replay, preference tracking, or marketing technologies. If Chudoly adds a materially different purpose or provider, the preference version must change and you will be asked again.
The effective date and preference version must change when the technologies, purposes, providers, categories, or material retention practices materially change.
Effective August 20, 2026
Necessary technologies
Always active| Name or provider | Type and contents | Purpose and practical duration |
|---|---|---|
| Chudoly access cookie | First-party, Secure, SameSite=Lax, HttpOnly cookie containing a signed pseudonymous Supabase user ID and expiration time. It contains no child profile data. | Lets protected pages and APIs recognize an authorized account. It expires according to the account-access period. Access may be disabled or revoked sooner, and “End private session” expires it on that browser. |
chudolyConsentChudoly | First-party local-storage record containing this policy version, timestamps, category choices, how the choice was made, and whether Global Privacy Control was honored. It contains no name, email, child data, or cross-site identifier. | Remembers your choices and avoids repeatedly asking. It expires after 180 days, is replaced when you save new choices, and is ignored when the policy version changes. You can remove it using the privacy controls. |
| Cloudflare Turnstile Cloudflare | Security script and challenge frame on invitation and returning sign-in forms. Cloudflare processes browser, device, request, and challenge signals and may use cookies or local storage needed for the challenge. | Helps distinguish people from automated abuse. Challenge tokens are short-lived; any Cloudflare challenge or clearance state follows the applicable Cloudflare configuration and policies. |
Chudoly browser storage
Limited| Name | Contents | Purpose and practical duration |
|---|---|---|
chudolyProfile | Legacy session-storage key. Chudoly no longer writes it. | The clear and end-session actions remove it from browsers that used an earlier Chudoly version. |
chudolyChildId | Legacy child profile identifier. | Chudoly no longer writes this persistent local-storage key. The clear and end-session actions remove it from browsers that used an earlier Chudoly version. |
chudoly-provider-session | First-party Supabase authentication session for an organization management account. It is separate from the invitation-only family access cookie and contains no child or family profile data. | Keeps an authorized organization manager signed in to the management portal. It refreshes only while valid and is removed when the manager signs out or uses the browser-data clear control. |
chudoly-claim-status-*chudoly-published-challenge-* | First-party session-storage records containing private provider-claim status or published-contact verification tokens scoped to a claim identifier. | Lets an authorized claimant continue a private claim-status or verification flow in the current browser session. The browser removes session storage when its session ends, and Chudoly's clear-browser control removes matching entries sooner. |
chudoly.providerQueueView | First-party local-storage value containing either the compact or detailed provider-review layout choice. | Remembers an administrator's optional review layout only after Functional consent. It remains until replaced or cleared and is ignored while Functional consent is off. |
This action clears the Chudoly browser keys listed above, including any provider portal session. It does not delete a child, parent, provider, or organization record held on Chudoly’s servers, end the HttpOnly family-access cookie, or change your separate privacy preference record. To request server-side access, correction, or deletion, email hello@chudoly.com.
Product learning and newsletters
Server-side onlyChudoly's first-party product-learning records and newsletter preferences are stored on the server, not in cookies, local storage, or session storage. Interaction requests use the signed-in adult's existing private session and contain only an allowed action, structured reason when applicable, and opaque recommendation, edition, or activity identifiers. They do not contain child names, ages, interests, family accessibility notes, ZIP codes, or raw planning constraints.
Weekly recommendations are off by default and require an explicit account-settings choice. Email contains no tracking pixel. Chudoly requires Resend open tracking and link rewriting to remain disabled. A one-click unsubscribe link contains an opaque signed token, removes its token from browser history when opened, and does not create browser storage.
Optional technologies
Two Functional services| Name or provider | Type and contents | Purpose and practical duration |
|---|---|---|
| Google Maps Adventure Map | Google Maps JavaScript API or an embedded Google map, with a map-marker clustering library when needed. The browser connects directly to Google Maps only after Functional consent. | Displays completed family adventures on an interactive map. Chudoly removes the map when Functional consent is withdrawn; Google handles its request and technology state under its own policies. |
| Provider review queue view Chudoly | First-party local storage containing only an administrator's compact or detailed layout choice. | Remembers the optional provider-review layout after Functional consent. It is ignored while consent is off and can be removed with the browser-data clear control. |
- Functional: contains the Google Maps Adventure Map and provider review queue preference described above and is off by default.
- Analytics: no configured services.
- Advertising: no configured services. Chudoly does not use advertising, behavioral profiling, sale/share-related use, or cross-site tracking and does not sell personal information.
The preference center shows an optional category only when it contains a configured consent-controlled service. A future optional integration must register both enable and disable behavior with Chudoly’s consent system, and the policy version must be updated when purposes or providers materially change.
Your controls
You can accept configured optional technologies, reject them, or save a category choice. The actions are available at the same level. Optional choices start off, closing the preference window does not count as consent, and you can reopen “Cookie preferences” at any time to withdraw or change a choice.
Global Privacy Control: when your browser sends a Global Privacy Control signal, Chudoly keeps any advertising and sale/share-related category off. Chudoly does not currently configure that category and does not sell or share personal information for cross-context behavioral advertising.
Service-provider information
Cloudflare provides Turnstile security on protected forms. See Cloudflare’s Privacy Policy and Website Terms. Google provides the optional Adventure Map. See Google’s Terms of Service and Privacy Policy. If another optional third-party service is added later, its identity and purpose must be disclosed here and in the preference center before relying on a new consent.
Browser controls
You can also delete or block cookies and site data in your browser settings. Blocking or deleting the Chudoly access cookie ends access on that browser; it does not disable the account or delete server-side data. Removing chudolyConsent causes Chudoly to ask for a new choice on a later page load.
For broader information about personal data, read the Privacy Policy.