Cookie Policy

• The sign-in cookie (normally __session) keeps your account signed in for up to 14 days. It is HTTP-only and secure in production. Firebase Authentication also manages sign-in state in browser storage until sign-out or removal.
• hawa_profile, hawa_match and hawa_assessment_consent in session storage carry your requested reflection and suggestions between pages in the current tab. They normally disappear when the tab closes, and are cleared on sign-out or through Privacy controls.
• hawa:cookie-notice:v1 remembers that you dismissed the essential-storage notice until you clear browser storage.
• Sanctuary browsing can remember scroll position for the current tab. Application forms may use hawa_sid to associate a submission with the browser.

These technologies support functions you request. Assessment processing has its own explicit consent step; agreeing to account terms is not assessment consent.

Spotify and YouTube players are blocked until you choose to load them. Loading one connects to that provider, which can receive your IP address, set cookies and process usage information under its own policy. You can remove a loaded player using its disable control, or reload the page. Consent is not saved across visits.

Disabling a player stops further requests from that embedded player. It cannot erase information the provider already received or cookies it set on its own domain; use your browser’s site-data settings for those cookies.

There are no optional analytics or marketing cookies to enable: visit counting uses no cookies. You can decline every external player and continue using HAWA. Your browser lets you inspect and remove stored data; blocking essential storage may prevent sign-in or completion of the reflection.

Use Privacy controls to erase assessment data, or contact hello@hawabeing.com with privacy questions. If optional tracking is introduced, it must stay disabled until the relevant consent is given.