Cookie Policy

We store pearl_joy_cookie_consent in local storage to remember your analytics choice, policy version, time of change, and a random consent identifier. It remains until you clear browser storage or a material policy update requires a fresh choice.

A matching pseudonymous event is stored in Supabase for accountability. It does not intentionally contain your name, email, Curate form answers, or raw IP address and is deleted after 24 months.

The inquiry pages embed a form from Curate. Loading and using that form connects your browser to Curate, which may process technical information and use technologies needed to display, secure, and operate the form. This form functionality is separate from our Google Analytics choice and is covered by Curate's own privacy practices.

Google Analytics 4 loads with analytics storage denied by default. Before you choose, or if you reject or withdraw consent, Google may receive limited cookieless pings. These may include consent status, page activity, timestamp, browser-supplied user agent, referrer, and a random value generated for that page load. They do not use Google Analytics cookies or persistent Analytics device identifiers.

Google may use these limited signals for aggregate or modeled reporting. If you accept, Google Analytics may set first-party analytics cookies and collect fuller visit and interaction data. Advertising storage, ad user data, and ad personalization remain denied. If you later withdraw consent, the site attempts to remove Google Analytics cookies created on this domain.

Lovable and supporting infrastructure may process limited request data and operational telemetry to deliver, secure, diagnose, and measure the hosted service. The consent audit endpoint also uses same-origin checks and one-way, short-lived rate-limit tokens to deter automated abuse. Network tokens rotate daily and rate-limit rows are removed after two days; raw network addresses are not stored in the audit tables.