Cookie Policy
1. WHAT COOKIES ARE
Cookies are small text files stored on your device by websites you visit. They help sites remember your preferences and understand how you use them. Tenang avoids them: the mobile app has no browser and sets none, and our own web pages set none either.
2. WHAT WE STORE INSTEAD
| Name | Type | Purpose | Duration | How to opt out |
|---|---|---|---|---|
| No first-party HTTP cookies | — | We set none on the app or our web pages. There is no _ga, _fbp, or ad cookie to list. | — | Nothing to clear. |
Cloudflare Turnstile (cf_clearance and similar, on Cloudflare's domain only) | Essential / security | Bot-check on the web sign-in and sign-up form. Runs in Cloudflare's own embedded frame. We don't read or receive these cookies, and they are never used for analytics or advertising. The native app does not use Turnstile. | Session to ~30 minutes (set by Cloudflare) | Required for web sign-in to work. See Cloudflare's privacy policy. |
| Device storage: app data, preferences, pre-consent analytics queue | Functional | Your journal and settings stay on your device. Before you answer the in-app analytics prompt, the app may hold a short local queue containing only a closed event name, its timestamp, and a random event id — capped at 100 events and seven days. | Until you delete it, or immediately on "No thanks" | Clear app data / uninstall. Tapping "No thanks" deletes the queue at once. See Privacy Policy §6. |
| PostHog anonymous / account id (device storage, not a cookie) | Analytics, consent-gated | Counts screen use, onboarding steps, trial starts, and confirmed purchases — only after you tap "Allow". Never your name, email, journal, mood, screening answers, or chat content. Session replay is off: no screen recordings leave your device. | Until you reject, wipe data, or sign out (identity is reset) | Answer "No thanks" on the in-app prompt, or wipe data in Settings. Nothing is ever sent before consent. |
3. NOTICE VS CONSENT
Our web pages need only this informational notice: they use no analytics or advertising cookies. Inside the app, analytics runs behind an interactive Allow / No thanks prompt — rejecting is as easy as accepting, and rejecting means no analytics client is ever created. That is the prompt asking about device storage above, not about browser cookies.
4. THIRD-PARTY COOKIES
Only Cloudflare (bot protection, web sign-in only) may set cookies through our pages, on its own domain and under its own policy. Google Analytics, Meta, ad networks, Stripe, Supabase, RevenueCat, Sentry, and PostHog set no cookies through us.
5. HOW TO MANAGE COOKIES
- Browser: Chrome · Firefox · Safari · Edge
- Mobile: clearing the app's data removes device storage; uninstalling removes everything.
- Disabling essential security storage (Turnstile) may break web sign-in. Disabling anything else changes nothing, because there is nothing else.
6. DO NOT TRACK
Tenang does not currently respond to Do Not Track signals because no uniform standard exists.
7. CHANGES
We will update the date at the top of this page when this policy changes. Material changes will be announced in the app before they take effect. For the full picture, read the Privacy Policy.