Spongle Cookie Policy

Spongle is currently operating in a pre-launch and testing phase. We use a small number of essential cookies and on-device storage to keep you signed in, keep the Platform secure and remember your preferences. With your consent, we may also record key product-usage events and the types of pages you visit so we can improve Spongle. At a glance Essential cookies and storage help keep Spongle secure and functioning correctly. Analytics and other non-essential technologies are off by default where consent is required. You can switch optional analytics on or off at any time. Page information is generalised before it leaves your device, so we see the type of page rather than its exact address. We do not use advertising cookies, behavioural advertising trackers or cross-site tracking. You can manage non-essential storage at any time through your cookie settings. Some storage or analytics described in this Policy may relate to features that are not yet commercially available.

Spongle is currently operating in a pre-launch and testing phase. Some features described in this Cookie Policy may not yet be commercially available or enabled for all users. Cookies, local storage, analytics and other similar technologies associated with a particular feature will only be used where: the relevant feature is available; the technology is reasonably required for that feature; and its use is permitted under applicable law. Where consent is required for analytics or other non-essential technologies, those technologies will not be activated unless the user has provided the required consent. As Spongle develops and additional features become available, we may update this Cookie Policy to reflect changes to: cookies; local storage; session storage; analytics tools; security technologies; and other similar storage or access technologies used by the Service. Where a material change affects how non-essential technologies are used, we will update the information made available to users and obtain any consent required by applicable law before activating those technologies. Your Choices You remain in control of non-essential cookies and similar technologies. Where consent is required, you can: choose whether to enable optional analytics; change your preferences later; withdraw consent at any time; and manage available options through Spongle's cookie settings. Essential cookies and storage may continue to operate where they are necessary for security, authentication, fraud prevention or the core functionality of the Service.

You remain in control of non-essential cookies and similar technologies. Where consent is required, you can: choose whether to enable optional analytics; change your preferences later; withdraw consent at any time; and manage available options through Spongle's cookie settings. Essential cookies and storage may continue to operate where they are necessary for security, authentication, fraud prevention or the core functionality of the Service.

This Cookie Policy explains how Spongle Limited ("Spongle", "we", "us", "our") uses cookies and similar storage technologies on our website (spongle.co) and in our iOS and Android apps. It should be read alongside our Privacy Policy. We use these technologies in accordance with the Irish ePrivacy Regulations (S.I. 336 of 2011) and, for UK users, the Privacy and Electronic Communications Regulations (PECR).

A cookie is a small text file stored on your device by your browser. We also use related technologies: local storage and session storage (data held by your browser) and, in our mobile apps, secure on-device storage (the iOS Keychain and Android EncryptedSharedPreferences). In this policy we refer to all of these together as "storage".

Strictly necessary — required to sign you in, keep the Platform secure, and provide core functionality. These are always active and do not require consent. Functional — remember your preferences (for example, dark mode and layout choices). Analytics — with your consent, we record key product-usage events (for example, publishing a campaign or submitting a pitch) and which pages you visit, to understand how the Platform is used and improve it. Page records are generalised before they leave your device: we record the type of page rather than its exact address, so a reference to a particular campaign, pitch or profile is replaced with a placeholder, and anything following the address — such as a query string — is discarded. This means we can see that a campaign page was viewed, but not which campaign it was. This category is off by default and switched on or off through the cookie banner or your privacy settings. It also covers the moment you leave a page, which lets us measure how long pages are viewed, and automatic technical reports when part of the Platform fails on your device, which we use to find and repair faults. It is processed on our behalf by PostHog, an analytics provider whose servers are located in the EU; events are recorded against your account ID and account type only, use on-device storage rather than third-party cookies, and are never used for advertising. Marketing / advertising — we do not use advertising cookies or third-party marketing trackers.

On the website (spongle.co): Name / item Type Category Purpose Set by Duration sidebar:state Cookie Functional Remembers whether the sidebar is open or closed Spongle (first-party) About 7 days Sign-in session (e.g. sb-…-auth-token) Local storage Strictly necessary Keeps you signed in Spongle / Supabase Until you sign out or it expires Preference items (appearance / dark mode, notification, view and layout preferences, device identifier, country) Local storage Functional Remembers your settings Spongle Until cleared Consent record (cookie-consent, cookie-consent-given, consent date) Local storage Strictly necessary Records your cookie choices Spongle Until cleared Sign-in / social-connection flow state Session storage Strictly necessary Completes sign-in and social-account connection flows Spongle Cleared at the end of the session __cf_bm, cf_clearance Cookie Strictly necessary Bot management and security Cloudflare (our CDN) Short-lived Bot-challenge token (Turnstile) Storage Strictly necessary Distinguishes humans from automated abuse Cloudflare Session Analytics events (ph_…_posthog) Local storage Analytics — consent required Records product-usage events and generalised page views, only if you switch analytics on PostHog (EU region) Until cleared or you withdraw consent Please note: our web app keeps your sign-in session in your browser's local storage, not in a cookie. Admin area (staff only): our internal administration area uses session cookies. These are not set on the customer-facing website. Mobile apps: session tokens are held in secure on-device storage (iOS Keychain / Android EncryptedSharedPreferences). The apps do not use HTTP cookies. What we do not use: third-party advertising cookies, Google Analytics, Meta Pixel, advertising trackers, or cross-site tracking of any kind.

The only third parties that may set storage through our Platform are the infrastructure providers that host and protect it, together with our analytics provider where you have given consent: Cloudflare, Inc. — sets short-lived security cookies (__cf_bm, cf_clearance) and the bot-challenge token to protect the Platform from automated abuse. See Cloudflare's Cookie Policy and Privacy Policy. Supabase, Inc. — provides the authentication and data services that keep you signed in. Your account data is stored in the EU region. See Supabase's Privacy Policy. PostHog — if, and only if, you switch analytics on, records product-usage events and generalised page views (the type of page, not its exact address) and stores an analytics identifier in your browser's local storage. It never sets a cookie, and its servers are located in the European Union. See PostHog's Privacy Policy. Where Cloudflare processes limited technical data (such as your IP address) outside the European Economic Area, including in the United States, the transfer is protected by appropriate safeguards — the European Commission's Standard Contractual Clauses, and adequacy mechanisms (such as the EU–US Data Privacy Framework) where they apply. We do not permit these providers to use this data for advertising or cross-site tracking. Further detail on international transfers is in our Privacy Policy.

Strictly necessary storage is set without consent, as permitted under Regulation 5(5) of the Irish ePrivacy Regulations (and, for UK users, Regulation 6(4) of PECR), because it is essential to provide a service you have requested. For any non-essential storage we rely on your consent, which you give through our cookie banner and can withdraw as easily as you gave it, at any time, in your cookie settings. Our usage analytics (described in Section 3) is off by default and runs only if you switch on the Analytics category; switching it on or off does not itself place a cookie on your device — your choice is stored as a strictly necessary consent record (see Section 4). We do not set advertising or marketing cookies, and the Marketing category in the banner is reserved for future use and currently has no effect; if we ever introduce any such cookie, it will remain switched off until you opt in. When you make a choice in our cookie banner, we keep a record of that choice and the date you made it, so we can honour it and demonstrate that consent was given. You can change your choice at any time.

Use the cookie settings in the app or on the website to review and change your choices. Use your browser settings to block or delete cookies (note that blocking essential storage may stop you signing in). Disconnect any connected social accounts in your settings at any time.

Your rights over your personal data, and how to exercise them, are set out in our Privacy Policy. You may also lodge a complaint with the Data Protection Commission (Ireland, dataprotection.ie) or, for UK users, the Information Commissioner's Office (ico.org.uk).

We may update this Cookie Policy from time to time. Where changes are material, we will let you know. For any questions about this policy, contact privacy@spongle.co.