Cookie Policy

Effective Date: November 5, 2025 Last Updated: November 5, 2025

Introduction

At Cibarious, we believe in transparency about how we collect and use information when you visit our AI-powered narrative database at www.cibarious.org. This Cookie Policy explains what cookies and similar technologies we use, why we use them, and how you can manage your preferences.

We apply EU-level data protection standards globally, ensuring consistent privacy protection for all our users regardless of location.

What Are Cookies?

Cookies are small text files stored on your device when you visit websites. They help websites remember your preferences, analyze how you use the site, and provide personalized experiences. We also use similar technologies like local storage and session storage.

Categories of Cookies We Use

Strictly Necessary Cookies

These cookies are essential for our website to function properly and cannot be disabled.

Authentication & Security

1. Supabase authentication tokens: Enable secure login and session management

1. Purpose: Maintain your logged-in state and secure access to your account

1. Duration: Access tokens expire after 1 hour; refresh tokens up to 1 week

1. Legal basis: Legitimate interest (essential for service functionality)

Consent Management

1. Cookie consent preferences: Remember your consent choices for analytics and advertising

1. Purpose: Ensure we respect your privacy preferences and comply with data protection laws

1. Duration: 12 months

1. Legal basis: Legal obligation (GDPR compliance)

Functional Cookies

These cookies enhance your experience but are not strictly necessary. They require your consent. User Preferences

1. Language settings: Remember your preferred language (planned feature)

1. Purpose: Provide content in your chosen language

1. Duration: 12 months

1. Legal basis: Consent

Pantry Storage

1. Saved ingredients and items: Store your pantry items locally and sync with your account

1. Purpose: Remember your saved items between visits

1. Duration: Indefinitely in local storage (anonymous users) or until account deletion (logged-in users)

1. Legal basis: Consent for enhanced functionality

Analytics Cookies

These cookies help us understand how visitors use our website. They require your consent. Google Analytics (when implemented)

1. Purpose: Analyze website traffic, user behavior, and improve our service

1. Data collected: Page views, session duration, bounce rate, device information

1. Duration: Varies (typically 2-26 months depending on specific cookie)

1. Legal basis: Consent

1. Data processing: Google Analytics data is processed in the US with appropriate safeguards

Advertising Cookies

These cookies are used to deliver relevant advertisements. They require your consent. Google Ads (when implemented)

1. Purpose: Show relevant ads and measure advertising effectiveness

1. Data collected: Ad interaction data, conversion tracking

1. Duration: Varies (typically 30 days to 2 years depending on specific cookie)

1. Legal basis: Consent

1. IAB TCF 2.2: We use the IAB Transparency & Consent Framework 2.2 via InMobi CMP for enhanced advertising consent management

Consent Management Platform

We use InMobi CMP (Consent Management Platform) as our primary consent management solution. This platform:

1. IAB TCF 2.2 Compliance: Generates valid TCF consent strings and uses the official IAB Global Vendor List (GVL)

1. Unified Consent Management: Single source of truth for all cookie consent preferences

1. Google Integration: Automatic integration with Google Ads and Analytics consent requirements

1. User Control: Accessible cookie preference center that can be opened at any time

1. Data Persistence: Consent preferences are stored locally for anonymous users and synchronized with your account for logged-in users

You can manage your cookie preferences at any time by clicking "Cookie Preferences" in our footer or header menu, which will open the InMobi CMP interface.

How We Use Cookies

We use cookies to:

1. Authenticate users and maintain secure sessions

1. Remember your preferences and consent choices

1. Store your pantry items and synchronize them across devices

1. Analyze website performance and user behavior (with consent)

1. Deliver relevant advertising and measure campaign effectiveness (with consent)

1. Ensure website security and prevent abuse

Your Rights and Choices

Managing Cookie Preferences

You can manage your cookie preferences at any time through:

1. Cookie banner: Appears on your first visit and allows initial consent choices

1. Cookie settings: Access through our cookie preference center via the "Cookie Preferences" link in the footer or header

1. Browser settings: Most browsers allow you to refuse or delete cookies

Consent Withdrawal

1. You can withdraw consent for analytics and advertising cookies at any time

1. Withdrawing consent will not affect processing based on consent before withdrawal

1. Some functionality may be limited if you refuse functional cookies

Account-Based Preferences

1. Logged-in users: Your consent preferences will be synchronized with your account

1. Anonymous users: Preferences are stored locally on your device

Browser Controls

You can also manage cookies through your browser settings:

1. Chrome: Settings > Privacy and security > Cookies and other site data

1. Firefox: Settings > Privacy & Security > Cookies and Site Data

1. Safari: Preferences > Privacy > Cookies and website data

1. Edge: Settings > Cookies and site permissions

Note that disabling all cookies may affect website functionality.

Third-Party Services and Data Transfers

We work with the following service providers who may set cookies or process your data:

Infrastructure Providers

Netlify (Website Hosting)

1. Location: US-based with global CDN

1. Data protection: Covered by Privacy Shield successor frameworks and Standard Contractual Clauses

Supabase (Database & Authentication)

1. Location: AWS US-East-2 data center

1. EU users: Data may be transferred to the US under appropriate safeguards

1. Data protection: Standard Contractual Clauses and other legal transfer mechanisms

Cloudflare (Content Delivery Network & Security)

1. Location: Global content delivery network with data centers worldwide

1. Purpose: Website performance optimization, DDoS protection, and security services

1. Cookies: May set cookies such as _cfbm for bot management and security

1. Data protection: Cloudflare's privacy policy, data processing agreements, and security measures

Communication Services

SMTP2GO (Email Services)

1. Location: EU data residency available (Amsterdam data center for EU users)

1. Purpose: Authentication emails (magic links) and planned newsletter communications

1. Data protection: Data Processing Agreement in place

Analytics & Advertising (When Implemented)

Google Analytics & Google Ads

1. Location: Global processing with primary servers in the US

1. Data protection: Google's data transfer safeguards and your explicit consent

1. IAB TCF: We use the IAB Transparency & Consent Framework 2.2 via InMobi CMP for enhanced compliance

Umami Analytics (Privacy-Focused Analytics)

1. Location: Self-hosted or cloud-hosted analytics service

1. Purpose: Website analytics and usage statistics (with your consent)

1. Cookies: Privacy-first analytics with no cookies by default

1. Data collected: Anonymized page views, session data, device information (no personal identifiers)

1. Data protection: Privacy-first analytics, GDPR compliant, anonymized data collection

Consent Management

InMobi CMP (Consent Management Platform)

1. Location: Global processing

1. Purpose: Managing cookie consent preferences and generating IAB TCF consent strings

1. Data protection: InMobi's privacy safeguards and GDPR compliance

Security & Fraud Prevention

IpQualityScore (Fraud Prevention & Security)

1. Location: US-based processing with global coverage

1. Purpose: Detecting and preventing fraudulent activity, bot detection, and security monitoring

1. Cookies: May use cookies or similar technologies for device fingerprinting and fraud detection

1. Data collected: IP addresses, request metadata, device fingerprints (anonymized)

1. Data protection: Data Processing Agreement, encryption, and security safeguards

Data Retention

1. Authentication tokens: 1 hour (access) to 1 week (refresh)

1. Consent records: 12 months

1. Functional preferences: 12 months (language settings)

1. Pantry data: Until account deletion or manual removal

1. Analytics data: As per Google Analytics retention settings (when implemented)

1. Umami Analytics data: As per Umami Analytics retention settings (when implemented)

1. Security logs: Maximum 12 months for fraud prevention (IpQualityScore)

International Data Transfers

Some of our service providers are located outside the EU/EEA. When we transfer your data internationally, we ensure adequate protection through:

1. Standard Contractual Clauses approved by the European Commission

1. Adequacy decisions for countries with equivalent data protection

1. Your explicit consent for specific transfers

Changes to This Policy

We may update this Cookie Policy to reflect changes in our practices, technologies, or legal requirements. When we make material changes:

1. Effective date will be updated at the top of this policy

1. Website notification may be displayed for significant changes

1. Continued use of our website after changes indicates acceptance

We encourage you to review this policy periodically.

Contact Information

If you have questions about our use of cookies or this policy, please contact us: Email: [email protected] Website: www.cibarious.org Data Controller: Francesco Paolo Maria Di Salvia (Individual ownership) Location: Corso Vittorio Veneto, SNC - 84020 Valva (SA) - Italy Note: As we grow, our legal structure may evolve to include a registered company entity. This policy will be updated accordingly.

---

This Cookie Policy is designed to comply with the EU General Data Protection Regulation (GDPR), ePrivacy Directive, and other applicable data protection laws. We apply these standards globally to ensure consistent privacy protection for all users.