Cookies & browser storage
Updated October 16, 2026. Optional usage analytics, campaign attribution and Sentry diagnostics each require a separate choice. Public guides and tools work with all three off.
Hosting cookies before your choice
OpenAI Sites sets __Host-appgarden-visitor before you make a privacy choice. In our October 16, 2026 browser check it was a first-party, Secure, HttpOnly visitor identifier with a lifetime of approximately 90 days. Our page code cannot read it or prevent the host from setting it. Choosing Keep optional off does not remove it.
We have asked OpenAI whether this cookie can be disabled or held back until consent, and to confirm its exact purpose and retention. Its classification is pending that response; we do not currently describe this visitor identifier as strictly necessary. This hosting cookie is separate from our consent-controlled gos_vid and gos_sid analytics cookies.
Cloudflare also sets __cf_bm for bot protection, normally for about 30 minutes. Hosting cookies may be present even when optional analytics, campaign attribution and diagnostics are off. You can clear or block cookies in your browser; the hosting service may set them again on a later request.
Storage inventory
Privacy preferences — vovi-funnel-privacy-v2, first-party localStorage. Stores the notice version, chosen categories and saved/expiry times for 180 days. It is used to honor your choice. A legacy v1 preference is removed and does not authorize new optional collection.
Visit-count cookies — gos_vid and gos_sid, first-party cookies. Set only after you allow usage analytics. gos_vid is a random identifier used to count unique visitors, kept 365 days; gos_sid marks the start of a visit and expires when the browser closes. Both are deleted when permission is withdrawn.
Counting choice — gos_consent, first-party cookie. Stores your usage-analytics choice (allowed or refused) for 180 days. After a refusal it is the only one of these cookies kept.
Diagnostic switch — site-diagnostics, first-party localStorage. Mirrors whether diagnostics are allowed; it cannot activate Sentry without a current, unexpired diagnostic choice. It is reset to denied when permission is withdrawn, expired or blocked by a browser privacy signal.
Campaign attribution — vovi-funnel-attribution-v1:<site>, first-party sessionStorage. Only after enabling campaign attribution, stores the validated first page and campaign labels in the current tab. It is cleared when permission is off or expires; a browser may restore a tab session. It contains no contact fields.
Saved tools — <site>:<tool>:v1, first-party localStorage. Created only when you press Save on this device. Remembers the non-contact tool inputs until you press Clear saved choices or clear the site’s browser data. This requested save is separate from optional analytics.
Contact details — not stored. This site has no contact form and saves no names, email addresses or phone numbers to localStorage or sessionStorage.
Hosting and optional services
OpenAI Sites and Cloudflare deliver and protect the website. Their essential security or routing technologies may process browser/network information or set service cookies. They are separate from our optional analytics and attribution controls. The first-party application does not use advertising pixels or session replay.
Without any choice, page views and link clicks are counted anonymously by our own analytics service, hosted on Vercel: page path, language, device type, referring hostname, campaign labels and coarse country. These counts carry no identifier, set no cookie and do not store your IP address. Global Privacy Control and Do Not Track stop them.
Opted-in error events go to Sentry; these omit raw error details and contact fields, but the receiving service still sees technical network information. Browser cookies and local storage are different technologies; this page describes both where relevant.
Change or withdraw a choice
Open Privacy choices from any page. Choose each category independently, or use Keep optional off to refuse all optional collection. Global Privacy Control and Do Not Track override optional permissions. The controls apply to this browser and site, so repeat a choice on another device or domain.
You can also clear cookies and site data in your browser. That removes saved preferences and tool settings. To ask us to delete an email you sent, use the privacy-request contact in the privacy notice. Browser restrictions may prevent saving preferences; the default remains off.