Cookie Policy

🔍1. Understanding Cookies and Local Storage

• Cookies: A cookie is a compact text file that a web server saves within your local web browser during an active session loop. Cookies enable web services to preserve authentication state, recognize cross-subdomain transitions, and synchronize user choices across an entire monorepo environment.
• Local Storage (localStorage): Local storage is an alternative data framework native to modern web browsers. It holds data configurations locally on your machine with no programmatic expiration date, persisting even after the web browser is closed and reopened.
• In-Memory Volatile Storage: Application query states, real-time telemetry caches, and live messaging streams are handled exclusively within volatile client-side or server-side runtime memory structures (such as core React Query states). These states are completely destroyed upon a page refresh or an active application logout cycle.

🛠️2. Comprehensive Storage Inventory

JoltSMS segments its storage footprints into transparent functional categories based directly on our active codebase layout. Every active cookie and storage key utilized across our properties is detailed below:

Strictly Necessary Storage (Platform Operations & Consent)

These tracking items are technically required to enforce platform security, preserve user identity loops, record your privacy choices, and deliver real-time data elements. They do not require prior user consent under global privacy frameworks:

First-Party Product Analytics & Performance

We deploy analytical tools — specifically PostHog (product analytics) and Google Analytics 4 (audience and acquisition reporting) — to optimize platform functionality and measure performance across both our marketing site and our authenticated user dashboard layouts. The Google Analytics script (gtag.js) is loaded directly from Google’s edge servers (googletagmanager.com) when consent is granted, and pageview events are transmitted to Google’s analytics infrastructure. These elements are strictly conditional and remain gated by your preferences chosen inside our cookie consent management widget:

Third-Party Financial Integration Storage

When our checkout interfaces or subscription management panels load, our platform dynamically provisions secure payment inputs provided directly by our merchant gateway, Stripe, Inc. Stripe deploys its own array of tracking keys strictly to evaluate transaction risk profiles, prevent payment-first fraud vectors, and execute mandatory regulatory multi-factor challenges:

🔒3. Analytics Engine Scope and Content Protections

JoltSMS utilizes PostHog product analytics and Google Analytics 4 across our environments to optimize user flows and monitor backend stability. However, we enforce explicit restrictions to ensure your private data streams remain completely isolated:

• Google Analytics Scope Boundary: Our Google Analytics 4 integration fires only standard, localized page_view events. It does not read DOM content, capture form inputs, ingest message body strings, or process inbound SMS payloads. The data Google receives is strictly limited to metadata such as URL path, referrer string, viewport dimensions, browser user-agent, and approximate geographic region.
• The ph-no-capture Security Shield: Our code explicitly isolates PostHog analysis using programmatic privacy tags. All dashboard interface views presenting raw inbound messages, parsed verification tokens, and newly generated automated developer API keys are wrapped inside a rigid ph-no-capture style mask. This ensures that sensitive data strings are redacted locally at the browser layer and are never transmitted to outside servers.

🎥4. Conditional Session Recording Disclosures

To debug transaction errors, optimize onboarding layouts, and provide support for complex billing workflows, JoltSMS selectively utilizes first-party session recording technologies via PostHog.

Execution and Isolation Boundaries

• Gated Activation Paths: Session recording routines (DOM event stream capture for layout optimization and customer support engineering) are deactivated by default during standard dashboard operation. Recording modules are programmatically triggered only when a user explicitly interacts with high-value operational paths: namely, during our step-by-step subscription allocation checkout wizard (SubscriptionWizard.tsx) or inside our dedicated payment configuration modal (ManageBillingDialog.tsx).
• Absolute PII Masking: In strict alignment with the protections detailed in Section 3, all textual entry areas, inbound SMS text outputs, and authorization keys are completely scrubbed from screen captures via our local code filters before being rendered to our internal support panels.

🎛️5. Managing Storage Controls & Automated Purging

You maintain complete control over the local storage parameters written to your hardware:

• Consent Options: You can alter or withdraw your non-essential analytical cookie authorizations at any time by accessing our user-facing cookie preference interface.
• Automated Consent Revocation Cleansing: If you revoke analytics consent after granting it, our consent management code immediately purges all active analytics cookies — both _ga / _ga_<container_id> (via the clearGACookies() routine) and ph_joltsms and its variants (via the clearPostHogCookies() routine) — from your browser session.
• Browser Disabling Configurations: You can configure your local web browser software to reject all incoming cookies or strip data keys from your localStorage arrays.

🏛️6. Jurisdiction, Venue, and Amendment Protocols

This document is governed and executed in absolute structural alignment with the laws of the State of Texas, USA. Any legal dispute or tracking regulatory controversy involving data handling at JoltSMS must be resolved exclusively through binding individual arbitration handled inside Tarrant County, Texas.

Material updates to our cookie configurations will be posted openly to this document, and notable operational variations will be broadcast directly across your authenticated dashboard using our internal system announcement architectures to display version notices right within your client-facing /alerts page view.

✉️7. Contact Information

For technical questions regarding your local tracking footprint or to audit your device storage keys, reach our privacy operations desk directly: