YET LEGAL
Cookie Policy
Last updated: September 29, 2026
This policy explains cookies, browser storage and related technologies on yet.social, operated by Tommaso Savorana, Italy. It distinguishes ordinary public pages from account-action and restricted administration pages. Read it with the Privacy Policy, which also covers the mobile app.
Cookies are small values stored by a browser and sent with matching requests. Local storage and IndexedDB can also retain data on a device without being cookies. A URL parameter, a location request or a server log is not itself a cookie, but can still involve personal data and privacy obligations.
Public website
Ordinary public pages do not use YET-set cookies, local storage or session storage for advertising or visitor analytics. The current site does not install Google Analytics, Google Tag Manager, Google Ads tags, Meta Pixel or TikTok Pixel, and does not embed third-party advertising pixels. Public pages do not currently use non-essential cookies requiring a consent banner. Hosting, security and requested features still involve the data processing described below.
Delivery, security and account actions
Hosting and security providers may process request information, such as IP address, browser information, timestamp and requested URL, to deliver pages, prevent abuse and maintain service security. Email account-action pages also process the one-time parameters required to verify an email, recover or change an email address, or reset a password. The account-action page sends the action code and, for a password reset, the new password directly to Google's Firebase Authentication API. Treat these links as private and do not forward them. These requests are for the account action you selected, not advertising profiles. Request and provider logs have separate retention from browser storage; see the Privacy Policy.
Technologies by feature
- Public browsing: pages and images are served through Firebase Hosting and YET server functions. Your browser can retain public files in its cache for faster loading, without an advertising identifier assigned by YET for this purpose.
- Nearby discovery: with browser permission, coordinates are sent to YET in the request URL to return nearby events. The page does not save them in a tracking cookie. Browsers manage permission persistence separately, and infrastructure request logs may contain the URL. Global live discovery does not require device location.
- Campaign links: an incoming link may contain
utm_source,utm_medium,utm_campaign,utm_contentorutm_termparameters identifying its source or campaign. YET can pass these values to Apple when you follow an App Store link from the homepage or an event or profile page. This link attribution does not create a YET campaign cookie. Avoid including personal information in campaign parameters. - Account-action pages: action parameters are read from the URL and used with Firebase to complete the requested action. Their validity is controlled by the authentication service; no analytics cookie is needed for this operation.
- Restricted administrator sign-in: this separate area loads Google's Firebase Authentication SDK and Google sign-in. Firebase uses browser authentication persistence, including IndexedDB or local storage where available, to keep the requested session. Local authentication state may survive closing the browser until sign-out, clearing site data or invalidation. Google's sign-in pages may use their own cookies. These functions are not loaded on ordinary public legal pages.
Essential storage is used only for the requested function and does not require consent where a legal exemption applies. This exemption does not cover unrelated profiling. For provider details, see Firebase privacy information and Google's cookie information.
App links and the App Store
Selecting an App Store or third-party link takes you to a service controlled by that provider. Cookies or other technologies used after leaving yet.social are governed by that provider's policy.
In-app, account-linked product analytics, notification tokens and device preferences are separate from website cookies and are described in the Privacy Policy. Browser cookie settings do not control these separate app processes. Account-linked app measurement currently has no separate in-app switch or consent prompt; the future website choices below are not controls or consent for that measurement. You can object to that processing through the contact and rights procedure in the Privacy Policy.
Future analytics and campaigns
None of the optional technologies below is active. They describe possible future configurations, not cookies currently on your device. There are no active YET advertising campaigns, server-side advertising event feeds, customer-list uploads or native advertising SDKs. Website analytics would be separate from the existing first-party, account-linked app measurement described in the Privacy Policy.
| Provider and technology | Possible purpose and storage |
|---|---|
| Google Analytics 4 (GA4) | Optional usage measurement through pseudonymous browser identifiers and approved generic interactions. Analytics cookies, if introduced, would require a separate analytics choice; Google Signals, User-ID and advertising links would not be enabled by that choice. |
| Google Ads tags | Conversion attribution using click IDs, browser identifiers and approved events; separately opted-in remarketing could reach previous visitors. Advertising storage and personalised advertising must not be bundled with analytics consent. |
| Meta Pixel and Conversions API | Browser cookies or server events for attribution and measurement; separately, retargeting and similar audiences. Events may be matched with Meta accounts. Advanced matching and customer-list use are not included in ordinary browsing or account acceptance. |
| TikTok Pixel and Events API | Browser cookies or server events for attribution and measurement; separately, retargeting and similar audiences. Events may be matched with TikTok accounts. First- and third-party cookie settings and automatic matching require review before activation. |
Before activation we must publish actual cookie names, domains and lifetimes, the selected receiving legal entities, purposes, data fields, event-retention and audience-membership periods, and any cross-device use. Provider defaults are not a YET retention commitment. An identifier set on our own domain can still be used for advertising: "first-party" does not make it necessary. Server-side events, tracking pixels and other identifiers can involve personal data even without a browser cookie. Hashing does not itself anonymise data. See the Privacy Policy for excluded data, minors' safeguards, customer matching, provider roles, transfers and applicable US sale/sharing and targeted-advertising rights.
Controls required before activation
Optional technologies will stay blocked until the relevant affirmative choice. A future control must offer Accept all, Reject all and granular choices, with no preselected optional purposes, and a persistent "Privacy choices" link to revisit or withdraw a choice as easily as giving it. These controls are not currently installed. Scrolling, continuing to browse or accepting the Terms is not consent. Refusing non-essential technologies will not prevent access to core public website content. Refusal and withdrawal must apply to the relevant providers and stop future browser and server-side advertising transmissions, with removal of non-essential identifiers under our control. Provider-held data and deletion requests are addressed separately in the Privacy Policy; deleting cookies alone does not erase server records.
Google Consent Mode is not a consent banner or a legal basis. Advanced configurations can send cookieless pings even when storage consent is denied. YET's activation boundary is to block optional analytics and advertising tags and their event requests before consent or after refusal, rather than silently enabling those pings. Consent choices must also govern any server forwarding. Applicable Global Privacy Control (GPC) opt-outs must be honoured, not treated as advertising consent; a browser preference does not automatically identify every other browser or device. Any future account-wide propagation must be explained before use.
Search Console ownership verification through DNS or an HTML verification token is separate from GA4 and does not itself install a visitor-tracking pixel. It does not authorise advertising or activate analytics. Consent to an optional cookie likewise does not authorise unrelated account access, advertising uses beyond the chosen purpose or AI model training.
Content rights and separate choices
Accepting optional cookies or advertising measurement does not grant a copyright or likeness licence for photos, music or other content. Uploading content or granting a licence under the Terms does not authorise optional tracking. Permission for YET to use specific material in a campaign must be assessed separately from permission to measure that campaign.
Refusing or withdrawing optional-cookie consent does not itself delete your content or end the operational content licence. To request content removal, report a rights issue or exercise a privacy right, use the reporting procedure or contact us under the Privacy Policy. Handling a rights complaint does not depend on accepting optional analytics or advertising. Clearing browser storage does not erase acceptance, licence or complaint records held on the server; their retention is governed by the Privacy Policy.
Manual safety review and separate choices
Manual public-content review for covered submissions is described in the Privacy Policy. It does not add browser advertising cookies. Restricted reviewer authentication uses the existing administration storage described above.
Google Cloud Natural Language and Vision safety checks are not active in this release. Content is not sent to those services for screening, including when an account has a saved AI preference. This notice and any saved preference do not authorise future AI processing. Google/Firebase infrastructure and optional Google sign-in remain separate uses described in the Privacy Policy.
A previously saved AI preference is a separate account record, not an advertising-cookie choice. Refusing optional cookies does not prevent a safety report or appeal. Clearing browser storage does not by itself withdraw a server-held preference; contact info@yet.social to request withdrawal. Neither manual review nor a saved AI preference authorises optional analytics, advertising, model training or disclosure of private chats to an AI provider.
Browser controls
Browsers allow you to inspect, block or delete cookies, cached files and other site data. Manage location permission in the browser's site settings. Sign out of the administrator area before using a shared device; deleting local data may end a session but does not delete server-side account records. Blocking essential storage or Google sign-in requests can prevent administrator authentication from working. There is currently no YET advertising-cookie preference to withdraw; for privacy requests, use the contact below.
Contact
Questions may be sent to info@yet.social.