PIKSPOT! Cookie Policy

How PIKSPOT! uses or may use cookies and similar technologies.

Last updated: 2026-09-22

This Cookie Policy explains how PIKSPOT! uses cookies, local storage, pixel tags, and similar technologies. PIKSPOT! is currently provided as a website, not a native app.

Article 1 — Cookies and similar technologies

Cookies are small text files stored on your device when you visit a website. They can help maintain sign-in sessions, security, and other functions. Local storage, session storage, pixel tags, and browser identifiers may serve similar purposes.

Article 2 — Necessary services

PIKSPOT! uses cookies or similar technologies necessary to provide the service to:

  • Maintain sign-in sessions, authenticate users, and protect account security;
  • Prevent abuse, fraud, and unauthorized access;
  • Store settings and local data directly needed for core functions;
  • Verify payments, subscriptions, and membership permissions; and
  • Update the most recent service activity time for signed-in accounts at most once every 24 hours, so public friend cards can automatically appear or be hidden under the 30-day activity rule.

Recent service activity records only a time, not the page, device, IP address, search text, or form content for that visit. This necessary service is separate from product analytics consent; disabling optional analytics does not stop activity time updates. Disabling necessary cookies or similar technologies may make some core functions unavailable.

When you manually select an interface language, PIKSPOT! stores that browser's choice in the functional cookie pikspot_locale for 1 year from that selection. The cookie uses HttpOnly and SameSite=Lax, with Secure set on HTTPS connections. It remembers your language and is not used for analytics or advertising tracking. It is separate from optional product analytics consent.

Signed-in accounts also store a language preference for the default interface language across devices and the language of newly created notifications. This preference is initialized when the account is activated and updated when you manually switch languages. Simply opening a shared link with a language-specific path displays the page in that language without overwriting the saved browser or account language preference.

PIKSPOT! also uses Vercel Web Analytics for anonymous, cookie-free basic page traffic statistics with sanitized URLs, and may use Vercel Speed Insights to diagnose website performance. Query parameters and identifiable long path segments are removed before transmission. PIKSPOT! account IDs, names, email addresses, friend codes, coordinates, search terms, form content, and image data are not attached.

Article 3 — Optional product analytics

PIKSPOT! loads Google Analytics 4 (GA4) only after you consent to product analytics, to understand:

  • Page views, DAU/WAU/MAU, and monthly page views per user;
  • Use by country or region, interface language, and generalized browser language;
  • Interactions with core features and their success rates; and
  • The overall support and membership funnel.

For signed-in users who consent to analytics, a hashed code that cannot be directly reversed to a Supabase account may be used as a GA4 User-ID to combine statistics across devices. PIKSPOT! does not send names, email addresses, Supabase user IDs, friend codes, public content, search terms, form content, coordinates, or payment card data to GA4. GA4 country or region information is generated by Google from technical information its service receives and is separate from the country or region selected on a friend card.

PIKSPOT! plans to set GA4 user-level and event-level data retention to 14 months and disable resetting the retention period on new activity. After you withdraw analytics consent, PIKSPOT! stops sending new optional analytics events. When an account is deleted, if GA4 is configured, PIKSPOT! submits a user data deletion request to Google using the same hashed User-ID. Temporary external service failures retain a retry status but do not prevent deletion of the PIKSPOT! account itself.

Article 4 — Advertising and Google AdSense

PIKSPOT! may use Google AdSense to help cover website operating costs. Whether ads appear remains subject to site-wide switches, page types, user permissions, and regional rules. In principle, ads do not appear on the home page, legal and trust pages, sign-in, account settings, payment forms, image uploads, error handling, reporting, or administration flows.

When you consent to personalized advertising, Google may use cookies, local storage, IP addresses, device information, and page information under its policies to display and personalize ads, limit frequency, measure performance, prevent fraud or invalid traffic, and improve services.

If you reject personalized advertising, PIKSPOT! may still request non-personalized or contextual ads from Google. These ads are not selected using a personal interest profile. However, Google may still process necessary IP address, device, and page information or use some storage technologies for ad delivery, frequency capping, aggregate performance measurement, security, and invalid traffic prevention. Rejecting optional items does not grant ad-free benefits.

Paid ad-free, membership, or administrator status is verified through the PIKSPOT! database and payment webhooks, rather than determined by cookies or analytics tools. AdSense requests should not load for users with valid ad-free eligibility.

PIKSPOT! does not track ad clicks itself. Advertising value across page types is analyzed through the official AdSense and GA4 integration and aggregate reports.

Article 5 — Regional consent mechanisms

In Taiwan and other regions using the PIKSPOT! custom consent interface, you can choose “Accept all,” “Reject optional,” or manage product analytics and personalized advertising separately.

For traffic from the European Economic Area, the United Kingdom, and Switzerland, PIKSPOT! uses a Google-certified consent management platform (CMP) to handle regional consent signals required for Google advertising. If country detection is temporarily unavailable, production uses the more conservative CMP route. The PIKSPOT! region endpoint returns only which consent mechanism to use and does not save the country code as friend card data.

PIKSPOT! does not request dates of birth or create age profiles from birth dates. Unless reliable signals about children or teenagers become available in the future, AdSense uses an “age unspecified” setting; this does not mean the user has been verified as an adult. If a user is later known to be a child or teenager, restrictions will be applied separately under the applicable rules.

Article 6 — Managing your choices

You can update your choices at any time through “Privacy settings” in the website footer. In regions where Google CMP applies, this opens Google's withdrawal or change interface. You can also delete or block cookies in your browser or device settings, but blocking necessary cookies may prevent sign-in or core functions from working.

Consent choices are saved in the current browser's local storage and do not automatically synchronize across browsers or devices. The service may ask again after website data is cleared.

Article 7 — Third-party services

Vercel, Google, Supabase, PAYUNi, sign-in providers, and other external services may use their own cookies or similar technologies according to their functions and policies. Such processing is governed by each service's terms and privacy policy.

Article 8 — Policy changes and contact

We may update this policy from time to time and indicate the last updated date. If purposes, providers, or choices change materially, we will provide notice or obtain consent again where appropriate.

For questions, contact: privacy@pikspot.app

Cookie Policy