Cookie policy

This page lists every cookie and similar storage Scopivo uses on scopivo.com and inside the Scopivo web application. For the broader privacy story, see the Privacy Policy.

Essential cookies (required)

These keep you signed in and the Service functional. Disabling them breaks the app.

• Authentication session: a signed, httpOnly cookie issued after you sign in. Used to identify your session on every request. Set by next-firebase-auth-edge; rotates automatically.
• CSRF / cookie-signature key reference: part of the authentication scheme.

Functional cookies

• Theme preference: remembers whether you chose light, dark, or system theme.

Analytics

Our analytics are self-hosted and pseudonymous, not anonymous: the operator can see which pages and features each signed-in account used and when, but never the content of your work. The cookies below support that.

• scopivo_sid: a session ID (random UUID, 24-hour expiry, regenerates after 30 minutes idle) that stitches successive pageviews into a session. While you browse without an account, the session record holds the pages viewed, the referring site, country, device and a short one-way hash of your IP address (a pseudonym; someone with database access could in principle match it back to an address). When you sign up or sign in, the session you are in, including the pages it viewed before that, becomes linked to your account and is visible to the Scopivo operator. Session records auto-delete after 90 days.
• scopivo_ft: a first-touch record set once, on your first visit (30-day expiry, httpOnly). It records where you first arrived from: the site that referred you, any campaign tags in the link you followed, the page you landed on, the date, and the country your connection appeared to come from. It carries no account or session identifier of its own. If you sign up within 30 days it is copied to your account, together with the id of the session you signed up in, so we know which source brought you.
• scopivo_internal: set only in the browser of a Scopivo operator after they open the operator pages (1-year expiry, httpOnly). It marks that browser's visits as internal so they are left out of visitor statistics. It is never set for customers.

Country is looked up from your IP address on our server using a bundled copy of the DB-IP Lite country database (“IP Geolocation by DB-IP”); only the two-letter country code is stored. The address itself is kept as the short one-way hash described above, used only for the approximate visitor count, and it auto-deletes with the record after 90 days.

We do not use Google Analytics, Facebook Pixel, advertising retargeting, or any other third-party tracker.

Bot protection

Cloudflare Turnstile, used on public booking pages, intake forms and the waitlist form (which only exists while the site is in coming-soon mode), is privacy-friendly and does not set cookies.

Email tracking

Resend, our email delivery provider, may include open and click tracking pixels on transactional emails by default. These pixels do not set cookies; they're used to confirm delivery and surface bounce/spam information back to us.

Changes to this policy

If we add a cookie or change how an existing one works, we'll update this page and the “Last updated” date above.

Contact

Questions? Email hello@scopivo.com.