Cookie Policy

Effective Date: March 30, 2026
Privacy Policy Terms of Service Data Processing Agreement BAA (HIPAA) Cookie Policy

1. What Are Cookies?

Cookies are small text files stored on your device (computer, smartphone, or tablet) when you visit our website or use our platform. They contain information about your browsing activities and preferences. Cookies help us provide you with a better experience by remembering your settings, maintaining your session, and understanding how you use our services.

In addition to cookies, we also use similar tracking technologies including:

2. How We Use Cookies

The table below describes the cookies and similar technologies we use on the AimwellBio platform. We categorize them by purpose and duration:

Cookie Name Provider Purpose Type Duration
sb-auth-token Supabase Maintains user authentication session and login state Essential Session
sb-access-token Supabase Stores JWT access token for API authentication Essential 1 hour
sb-refresh-token Supabase Allows automatic session refresh without re-authentication Essential 30 days
__vercel_live_token Vercel Enables live editing features during development and staging Essential Session
XSRF-TOKEN AimwellBio Security token to prevent cross-site request forgery attacks Essential Session
user_preferences AimwellBio Stores your dashboard layout, display settings, and interface preferences Functional 1 year
theme_preference AimwellBio Remembers your choice of light or dark mode theme Functional 1 year
language_setting AimwellBio Stores your preferred language for the interface Functional 1 year
_ga Google Analytics Tracks unique user visits and distinguishes users from each other Analytics 2 years
_gid Google Analytics Used to throttle request rate and count page views by session Analytics 24 hours
_gat Google Analytics Controls sample rate for Google Analytics traffic Analytics 1 minute
plausible_session Plausible Analytics Tracks user sessions for privacy-focused analytics (GDPR-compliant) Analytics 30 minutes
cf_clearance Cloudflare Verifies that your traffic is legitimate and not malicious Performance 30 days
__cf_bm Cloudflare Cloudflare bot management to prevent abuse and DDoS attacks Performance 30 minutes

3. Types of Cookies We Use

Essential Cookies

These cookies are necessary for the proper functioning of the AimwellBio platform. They enable core functionality such as authentication, security, and navigation. We cannot disable these cookies without affecting your ability to use our services. Essential cookies do not require your consent under most privacy regulations, but we inform you about them for transparency.

Functional Cookies

Functional cookies enhance your user experience by remembering your preferences and settings. These include your theme choice, dashboard layout, and language preferences. While these cookies improve usability, the platform will still function without them—you may simply need to re-set your preferences on subsequent visits.

Analytics Cookies

We use analytics cookies to understand how users interact with our platform. This helps us identify which features are most valuable, where users encounter difficulties, and how to improve overall performance. We use Google Analytics and Plausible Analytics for this purpose. Analytics cookies do not directly identify you but may be combined with other data to create usage profiles.

Performance Cookies

Performance cookies optimize platform speed and reliability. Cloudflare's security cookies protect our infrastructure from attacks and ensure fast content delivery. These cookies monitor performance metrics and threat patterns to keep our services running smoothly.

4. Third-Party Cookies and Services

AimwellBio integrates with several third-party services that may set their own cookies on your device:

Supabase (Authentication & Database)

Supabase provides our authentication infrastructure and backend services. Supabase sets authentication-related cookies to maintain your login session and secure your data access. Visit Supabase's privacy policy for details on their cookie use and data handling.

Vercel (Hosting & Deployment)

Our platform is hosted on Vercel's infrastructure. Vercel may set cookies related to content delivery, performance monitoring, and development features. Review Vercel's privacy policy for more information.

Google Analytics (Analytics)

We use Google Analytics to measure how users engage with our platform. Google Analytics sets cookies to track session duration, pages visited, user flow, and other engagement metrics. Google does not identify you personally through these cookies. Review Google's privacy policy and Google Analytics cookie documentation for additional information.

Plausible Analytics (Privacy-Focused Analytics)

In addition to Google Analytics, we use Plausible Analytics, which is GDPR-compliant and respects user privacy without requiring explicit cookie consent. Plausible does not use cookies to create user profiles or track individuals across websites. Review Plausible's privacy policy for details.

Cloudflare (Security & Performance)

Cloudflare protects our infrastructure from security threats and optimizes content delivery. Cloudflare's security cookies help prevent attacks while maintaining platform performance. Visit Cloudflare's privacy policy for information about their cookie practices.

Stripe (Payment Processing)

If you initiate payment through our platform, Stripe's payment processor may set cookies to facilitate secure transactions and fraud prevention. Stripe does not store full credit card information on our servers. Review Stripe's privacy policy for details.

5. Managing Cookies

Browser Cookie Settings

Most browsers allow you to control cookie behavior through privacy settings. You can configure your browser to:

Note that disabling essential cookies may prevent you from accessing your account or using key platform features. We recommend keeping essential cookies enabled while controlling non-essential categories.

For instructions on managing cookies in popular browsers:

Google Analytics Opt-Out

You can opt out of Google Analytics tracking by installing the Google Analytics Opt-Out Browser Add-on. This add-on prevents your data from being sent to Google Analytics.

Plausible Analytics Exclusion

Plausible Analytics does not require opt-out mechanisms because it does not create user profiles or track individuals across sites. However, if you prefer not to be tracked, you can use any standard do-not-track header in your browser.

6. Cookie Consent and Preferences

Our Approach to Consent

AimwellBio respects your privacy choices. When you first visit our platform, you will see a cookie consent banner that explains which cookies we use and allows you to make informed choices. We distinguish between:

Withdrawing Consent

If you change your mind about your cookie preferences, you can update your choices at any time by:

When you withdraw consent for non-essential cookies, we will stop setting new cookies in those categories (though already-set cookies may persist until their expiration date or until you delete them manually).

Cookie Preferences Persistence

Your cookie preferences are stored securely in our systems and also saved as a cookie on your device (typically valid for one year). This ensures your choices are respected across visits. If you clear all cookies from your browser, you may need to re-set your preferences on your next visit.

7. Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature that sends a signal to websites indicating your preference not to be tracked. The interpretation of DNT signals varies across the internet, and there is currently no industry standard for how websites should respond to them.

While AimwellBio respects privacy-conscious users, we do not currently alter our cookie and tracking practices in response to DNT browser signals. However, you can achieve a similar effect by:

8. Changes to This Cookie Policy

We may update this Cookie Policy periodically to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by updating the "Effective Date" at the top of this page and, in some cases, by sending you a notification email or displaying a prominent notice on our platform.

Your continued use of the AimwellBio platform after any changes become effective constitutes your acceptance of the updated Cookie Policy. We encourage you to review this policy regularly to stay informed about how we use cookies.

9. Contact Us

If you have questions about our cookie practices, need clarification on how specific cookies are used, or wish to exercise your privacy rights regarding cookies, please contact us:

We will respond to your inquiry within thirty (30) business days. If you are located in a jurisdiction with specific privacy rights (such as the European Union, California, or other regions with privacy laws), we will ensure your requests comply with applicable legal requirements.

10. Jurisdiction-Specific Information

European Union (GDPR)

If you are located in the European Union, cookies are considered personal data under the General Data Protection Regulation (GDPR). We obtain your explicit consent before setting non-essential cookies on your device. You have the right to:

California (CCPA)

Under the California Consumer Privacy Act (CCPA), you have the right to request information about the categories of personal information we collect via cookies, including the purposes of use and the third parties with whom we share such information. You also have the right to opt-out of "sales" of personal information (though we do not sell personal information in the traditional sense). For more information, see our Privacy Policy.

Canada (PIPEDA)

If you are a Canadian resident, your personal information collected through cookies is protected under the Personal Information Protection and Electronic Documents Act (PIPEDA). You may request access to your information and opt out of certain types of tracking by contacting privacy@aimwellbio.com.