Cookies & browser storage

This policy describes storage and external services used by KepoGo. Effective October 2, 2026.

Necessary storage — always on

Supabase session cookies support authentication and refresh according to session settings. kepogo-locale remembers a selected language for up to one year. Requested theme and interface preferences, selected business/branch, shopping carts, guest order references, device/session identifiers, and installed offline POS data may use local storage, session storage, IndexedDB, or the service-worker cache. Session storage normally ends when the tab session ends; many local/offline records have no automatic expiry and remain until cleared or removed by the feature. Clearing these can sign you out, remove carts, or remove offline records. These operational purposes are not Google Analytics. Where configured, Cloudflare Turnstile protects public forms from automated abuse and may receive technical request information. Any clearance-cookie duration depends on the Cloudflare account configuration and has not been verified.

Your consent record

kepogo:privacy-choice:v1 in local storage and kepogo-privacy-choice in a first-party cookie store your choices, version, and timestamp for 180 days. Invalid, missing, expired, or old-version choices keep optional purposes off and trigger a new request on eligible pages. Material changes to purposes require a new consent version. If saving is blocked, explicit choices apply in memory for the current visit; referral persistence remains blocked without a valid consent cookie.

Google Analytics — optional

Google Analytics uses cookies such as _ga and _ga_* to measure visits to KepoGo marketing pages. The tag is not downloaded before consent (basic consent mode). This implementation limits its cookies to 180 days without automatic extension. It does not send your account email, customer orders, query strings, URL fragments, or referring URLs as page-view fields. Google receives the request’s network and device information. Server-side analytics retention is controlled separately in the Google Analytics account; the configured duration has not been verified.

Referral attribution — optional

kepogo-partner-referral is a signed, HttpOnly first-party cookie lasting up to 90 days. kepogo_referral_code can also hold the code locally for up to 90 days, or until registration, withdrawal, or browser clearing; it is only used while current referral consent is valid. Referral redirects can carry a ref query parameter to show the invitation, but do not persist attribution without permission. Accepting Analytics alone does not accept referrals.

Customer content and external services

KepoGo Analytics is disabled on hosted customer storefronts, restaurant and food-truck menus, and booking pages. Their carts, checkout state, guest order history, and security checks serve the requested transaction. Embedded Google Maps stays unloaded until you select Load Google Maps for that location. Remove map unloads it; no lasting map permission is stored. Google can receive your IP/browser information and use cookies under its own policy. KepoGo cannot remove cookies on Google’s domain. External social, directions, and payment links follow the linked provider’s privacy practices when opened.

Change or withdraw choices

Use Cookie settings in the website footer, select individual purposes, then Save preferences; Reject optional withdraws both. The analytics document is removed, future page tracking stops, and accessible Analytics cookies are expired. The referral deletion endpoint removes its HttpOnly cookie and accessible local attribution is cleared. Withdrawal cannot recall an in-flight request or erase previously collected data. Browser controls can clear remaining storage, including third-party cookies.

Rights and international processing

Privacy rights and applicable rules depend on your location and the service used. Contact hello@kepogo.com for access, correction, deletion, or privacy questions, and the customer business for its submissions. This site does not implement advertising consent. It does not override a Global Privacy Control signal with advertising permission. Transfers to overseas providers and retention require separate review; choosing optional cookies does not itself establish a valid transfer safeguard. When Global Privacy Control is detected, KepoGo keeps Google Analytics off, even if previously accepted.

Google Privacy · Google Analytics cookies

Built for small businesses that want to start organized from daily transactions.