Legal

Cookie Policy

This page explains everything GenoDyn Labs stores in your browser, why it is stored, and how long it stays. It covers cookies and the other browser storage we use, which the law treats the same way.

Last updated 24 September 2026

The short version

We set 3 cookies that are necessary for the site to do what you asked it to do: sign you in, keep you signed in, and deliver the analysis you paid for. Those cannot be turned off, because without them the site does not work.

We also use optional Google Analytics cookies. They tell us how many people visit and which pages they use, so we can see what's working. Google Analytics loads only after you say yes — if you decline, or haven't answered yet, Google Analytics does not receive data or set cookies.

We do not use advertising cookies, we do not sell your data, and we never send anything about your genetic results to an analytics provider. What they receive is which page was viewed, not what was on it.

Strictly necessary cookies

These cannot be switched off, because without them the site cannot function. Under UK and EU rules, cookies that are strictly necessary to provide a service you requested do not require consent — but they do require this disclosure.

NamePurposeRetainedSet by

sb-<project>-auth-tokenKeeps you signed in. Without it every page load would sign you out.Session / until sign-outFirst party (Supabase auth)

gdl_passShort-lived proof that you paid for the analysis currently running, so the evidence packs can be served to you.2 hoursFirst party

gdl_consentRemembers this cookie choice so you aren't asked on every page.180 daysFirst party

Website analytics

Vercel Web Analytics runs independently of your cookie choice. It counts visits and page views and reports traffic sources, approximate location, browser, and device type. It does not use analytics cookies. We send only recognized page addresses, without query strings or fragments; we do not send names, report identifiers, genetic findings, or chat contents. Cookie settings controls optional cookie-based analytics, not this cookieless measurement.

Marketing cookies

We do not use any, and we have no plans to advertise on the basis of your genetic data.

We do not currently set any cookies in this category.

Other things we store on your device

Cookies are not the only kind of browser storage, and the law does not treat them differently, so here is the rest of it:

Your reports (IndexedDB). Your annotated report is saved in your own browser so it loads instantly on your next visit. It stays on your device until you delete the report or your account.
Your selected plan (localStorage). A single value remembering which plan you last chose, so the billing page can show it back to you.

Your raw DNA file is never uploaded. It is read and analysed entirely inside your browser. What reaches our servers is the finished report — the markers you carry and their annotations — not the file itself.

Third parties

We keep these to a minimum, and none of them set cookies on this site. They are listed because they do receive your IP address, which is personal data:

Google Analytics. Only if you accept analytics cookies. Nothing is loaded from Google Analytics before that, and declining means it never runs.
Google Fonts. Typefaces are currently served from Google's network, which means Google receives your IP address when a page loads.
Stripe. Payments are handled by Stripe. When you check out you are taken to Stripe's own page, where Stripe's cookies and privacy terms apply. We never see or store your card details.
Supabase. Our database and sign-in provider. The session cookie in the table above is issued by them on our behalf.

How to control this

You can change or withdraw any optional choice at any time using — the same panel is linked from the footer of every page. A recorded choice lasts 180 days, after which we ask again.

Your browser can also block or delete cookies directly, through its own settings. Be aware that blocking the cookies in the necessary table will sign you out and prevent an analysis from running — not because we are penalising you, but because those cookies are how those features work.

To remove everything we hold about you, use delete my account in Settings. That removes your reports and your sign-in permanently.

Changes to this policy

If we start setting a cookie that is not listed here, we will update this page and ask for your consent before setting it. Any previously recorded choice stops counting when our cookie usage changes, so you will always be answering the current question rather than an old one.

Contact

Questions about this policy: [TODO: contact email]
[TODO: registered address]
[TODO: data protection registration, if applicable]