Cookie Policy

1. Summary

Maṅgalya uses strictly necessary cookies to run the service. All other cookies and similar storage (analytics, functional embeds, future advertising) load only after you consent. Rejecting works the same as accepting, closing the banner is not consent, and you can change or withdraw your choice anytime via Cookie settings in the site footer.

This Policy is read together with our Privacy Policy and Terms & Conditions.

2. Categories and durations

• Strictly necessary (always on, no consent): Firebase session and auth tokens (session + up to ~1 year persistent login), guest-password unlock cookie mangalya_guest_invite (30 days), template-preview unlock mangalya_template_preview (30 days), studio impersonation session (1 hour), Android shell flag, load-balancing and security cookies from our host. Legal basis: contract + legitimate interest; exempt under EU ePrivacy / UK PECR.
• Functional (opt-in): remembered preferences, consent record itself mangalya_consent_v1 (12 months), Google Maps embeds (only when a host adds a map and you allow functional), YouTube/Vimeo embeds (only when loaded). Withdrawing disables future loads; already loaded embeds stop on next page view.
• Analytics (opt-in): Mixpanel product analytics (identifiers in localStorage/cookies, including across public-invite subdomains; event history per Mixpanel retention) and Vercel Speed Insights performance beacons on public pages (short-lived). Both are blocked until you choose Accept all or enable Analytics in settings. EU/UK/Brazil visitors: prior opt-in. Consent renewed yearly.
• Advertising (opt-in, currently unused): reserved for future ad pixels. No advertising cookies are set today. Any future vendor will be listed here before it fires.

Error monitoring (Sentry) is diagnostic, not advertising: crash reports with technical details (URLs, device type, stack traces, PII capture disabled). Payment pages use Razorpay fraud-prevention storage under Razorpay's terms.

3. How to manage or withdraw

• Cookie settings (footer): open per-category toggles anytime; changes apply immediately and persist 12 months.
• Browser controls: block or delete cookies in your browser; some features (sign-in, guest unlock) may stop working.
• Do Not Track: Mixpanel honours browser Do Not Track in addition to consent.

4. Do Not Sell or Share (US states)

We do not sell your personal information for money. Where California, Colorado, Connecticut, Delaware, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, and other state laws treat analytics or advertising sharing as a "sale" or "share", you can opt out by choosing Reject all or disabling Analytics and Advertising in Cookie settings.

Global Privacy Control (GPC): if your browser sends a GPC opt-out signal, we treat it as a valid Do Not Sell/Share request automatically — analytics and advertising stay off even if a banner choice previously allowed them. No extra click needed. To exercise other state rights (know, delete, correct), email mangalya.app@gmail.com.

5. International visitors

EU/EEA and UK visitors receive a prior opt-in banner (GDPR + ePrivacy, UK PECR): no non-essential storage before consent, equal Accept/Reject, granular choice, and easy withdrawal. Brazilian visitors (LGPD) receive the same opt-in standard. Indian visitors (DPDP Act) receive this notice plus consent-and-withdrawal controls. Our global default is the strictest (opt-in), so all visitors get at least that protection.

6. Changes

When we add a vendor or category, we update this Policy, bump the date above, and re-ask for consent where the law requires it. Material changes are announced by an in-product notice.