Cookie Policy

This page lists every cookie DesireOS sets, why we set it, and how long it lives. We use only essential cookies and our own privacy-preserving, first-party analytics — no third-party ad trackers and no cross-site tracking. We never sell or share cookie data with advertisers.

There is no cookie banner. Our first-party analytics run on a legitimate-interest basis, and you can opt out at any time using the control in Your controls below.

These are required for the site to function. They don't need consent under PECR/GDPR.

• sb-* — Supabase authentication session. Set on login, cleared on sign-out. HttpOnly, Secure. ~1 hour rolling expiry.
• dos_funnel — signed first-party claim that remembers which companion you started chatting with and how many free messages remain. Required for the free chat and checkout. HttpOnly, Secure, SameSite=Lax. 30 days. Set automatically when you send a message or land from an ad — you do not need to click Accept.
• do_age_ok — records that you tapped 18+ on a lander. First-party, 30 days. Not a hard age-verification check.
• cookie_consent — records your analytics opt-out choice so we can honour it. Only written once you use the opt-out control below. 1 year.

Our own first-party analytics run by default on a legitimate-interest basis. They measure how the product is used and where visitors drop off — never to identify you personally, and never shared with advertisers or used for cross-site tracking. You can opt out at any time in Your controls below.

• anon_id — random UUID identifying your browser. 1 year. Used to stitch your visits together (e.g. drop-off funnels). Linked to your account on signup.
• analytics_sid — random UUID identifying your current visit. Sliding 30-min idle expiry. Used so server-fired events (chat, signup) attribute to the right session.

If you opt out, we still fire a bare page_view event with the normalised path (e.g. /app/m/[id]/chat), no query string, no referrer, no props — strictly necessary for spam/fraud detection and debugging.

Some flows require third-party cookies controlled by the processor:

• Payment processors — essential checkout security and fraud detection, loaded only when you open a payment flow
• Age verification (when wired) — for AVS attestation
• Email provider — delivery of transactional emails (verification codes, password resets)

None of these are loaded until you actively use the relevant feature. Each has its own policy linked at the point of use. None of them track you across other sites.

You can:

• Opt out of our first-party analytics at any time using the control below
• Clear cookies via your browser at any time — this also resets your analytics choice to on
• Request all data we hold about you (or its deletion) via the privacy policy