Cookie Policy — TrimProcure

Cookies are small files that a website saves in your browser. Trim also uses similar browser storage — local storage, session storage, and IndexedDB — and, for short, this policy calls all of it “cookies”. It explains which ones we use, why, and how you can control them. It sits alongside our Privacy Policy, which covers the personal data we handle more broadly.

• Essential storage only, by default. What’s described in sections 3 and 4 is needed to give you the service you asked for, so it doesn’t need your consent.
• Analytics only if you say yes. It’s off until you accept it. Declining, or ignoring the banner, keeps it off, and you can change your mind at any time.
• No advertising cookies, no selling your data, no cross-site tracking.

We aren’t running analytics today, so there’s no cookie banner. If we switch it on, you’ll be asked first and this policy will be updated.

Set by Trim, or by the sign-in and security tools we embed. These don’t need consent.

• Sign-in session. Firebase Authentication (a Google service) keeps you signed in — including as an anonymous guest — using your browser’s IndexedDB (database firebaseLocalStorageDb). It lasts until you sign out or clear your site data.
• Security check. Where it is active, Firebase App Check with Google reCAPTCHA Enterprise confirms that requests to our API come from the real Trim site, to prevent abuse. It keeps a short-lived token in IndexedDB (firebase-app-check-database), and Google may set its own _GRECAPTCHA cookie on google.com.
• Theme and language. theme and locale in local storage remember light or dark mode and your language. They last until you clear your site data.
• Sign-in hint. trim.lastUid remembers that you’ve signed in on this browser, so the right menus show straight away. It’s removed when you sign out.
• Buying or selling mode. roleMode remembers which side of Trim you were using.
• Your cookie choice. trim.consent remembers your answer to the cookie banner, so we don’t ask again on every visit.

A handful of other items hold things you’d expect the site to remember. Most start with trim.. They stay on your device — we don’t read or collect them — and you can clear them at any time in your browser settings.

• Drafts and work in progress. An unfinished audit, Idea Validator prompt, listing, or seller profile, so a refresh doesn’t lose it.
• Where to send you back. The page you were heading to before signing in or connecting GitHub, and a short back-navigation history for the mobile top bar.
• Things you’ve dismissed or finished. Banners and cards you closed, setup-checklist progress, and the intro splash, so they don’t keep coming back.
• Recent searches and onboarding answers. Used only to make search and your home screen more helpful on this browser.

If you accept analytics, we use PostHog (PostHog Inc.) to understand which pages are used and where things break, so we can improve Trim. PostHog processes the events in the United States. Nothing is loaded from PostHog, and nothing is sent to it, unless you’ve accepted.

• What we count. Page views. Each records the page’s route pattern — for example /audit/[auditId], never the audit’s id, a shared-report token, or a query string — plus your browser (including its user-agent string), operating system and device type, language, time zone, screen and window size, and the site you came from (domain only). PostHog also receives your IP address when your browser contacts it, and may derive an approximate location from it.
• What we don’t do. No session recordings, no recording of clicks, keystrokes or form text, no advertising, and no link to your Trim account: events carry only a random identifier, and we don’t create user profiles from them.
• What it stores. A random identifier and session details in your browser’s local storage, under keys beginning ph_ — no cookie. Withdrawing deletes them, leaving only a small marker that you opted out.
• Signals we respect. If your browser sends a Global Privacy Control signal, analytics stays off and we don’t show the banner.
• Legal basis. Your consent, which you can withdraw at any time (section 7). Withdrawing doesn’t affect anything done before you withdrew.

Separately from analytics, our own site sends our API a small anonymous report when something breaks in your browser and, for a sample of visits, page-speed measurements. Those reports carry no account or device identifier and use no cookies or browser storage.

Some features take you to another company’s site: signing in with Google, GitHub, or Apple, and paying through our payment provider’s hosted checkout. Those companies set their own cookies under their own policies, which we don’t control.

• Your browser. You can block or delete cookies and site data in your browser settings. Deleting essential storage signs you out and resets your theme, language, and drafts; blocking it may stop parts of Trim from working.
• Signals. We honor Global Privacy Control by keeping analytics off.

If we add a new kind of cookie, we’ll update this policy and ask again before using it. Questions: support@trimprocure.com.