Cookies and Similar Technologies Policy

MIND MOTOR PTE. LTD. ("YouMind", "we", "us" or "our") is the controller responsible for the technologies described in this policy. You can contact us at [email protected]. This policy applies when you use YouMind websites and web interfaces, including YouHome and YouMarketing, on a YouMind hostname. It supplements our Privacy Policy.

Cookies are small text records stored by a website in your browser. We also use similar technologies, including localStorage, sessionStorage, software development kits, pixels and browser identifiers. They can keep you signed in, protect the service, remember a choice, measure use, or attribute a referral. In this policy, “cookies” includes these similar technologies unless we say otherwise.

First-party technologies are set in the context of the YouMind site you visit. Third-party providers may receive your IP address, browser and device details, pseudonymous identifiers, request time, and the data described for each category. Page and referrer URLs sent to tracking retain the path and non-sensitive query; we remove the hash and authentication, token, code, email, next, search, and other sensitive parameters. We filter passwords, authorization and cookie values, OTP, OAuth and session secrets, raw prompts and searches, document text, complete file names or file URLs, raw error messages and stacks, and other clearly private free text; non-sensitive derived values may still be sent.

When Marketing is effectively enabled, FirstPromoter loads only when the gate confirms a safe public, non-preview route. It then receives the current allowed full public page URL—whose query may contain only allowlisted attribution parameters—and an allowed referrer. A same-origin referrer for a safe public route retains its allowed full URL with only allowlisted attribution parameters; a cross-origin referrer is reduced to its origin root. It never loads on authentication, OAuth, invite, email, unsubscribe, transit, preview or other sensitive routes.

Activation depends on region. In the EEA—including EU27, IS, LI, NO and AX—the UK and CH, Functional, Analytics and Marketing remain off until you make an affirmative choice. In the US and every other known country, all three categories run by default until you reject or customize them (opt-out). A valid explicit choice overrides the regional default.

The edge derives the mode from a trusted country code. If that is unavailable within 1,500 ms, the browser considers only an exact IANA timezone or an explicit language-region preference; a bare language, route locale, or Europe/* as a whole is not enough. With no clear strict-region signal, the fallback is opt-out. The necessary session cookie ym_privacy_regime stores only its version, mode and check time, never the country; it is trusted for at most 12 hours and revalidated in the background.

GPC forces Marketing off, but does not by itself disable Functional, Analytics or session replay. The notice lets you accept all, reject non-essential categories, or customize them, and the service remains available after rejection.

These technologies provide a service you requested or protect it: consent storage, authentication and session continuity, fraud and bot prevention, language/routing, and short-lived state required to complete an action such as sign-in or an invitation. For workflows you explicitly request, the temporary browser entries listed below may contain an invitation code, user prompts or article content and titles, file metadata or URLs, source URLs, an internal user ID, and workflow, model or destination settings. They are not analytics and expire after 15 seconds to 24 hours, or at the end of the session, as each row states. They cannot be switched off through the consent panel. Blocking them in your browser may prevent the service from working.

These technologies include passive Google One Tap and non-essential preferences. In strict regions they start when you allow Functional; in opt-out regions they run by default until you disable them. An explicit Google sign-in remains available as an authentication service you request.

When Analytics is effectively enabled, PostHog receives preview-compatible product events and the existing full account, subscription and business properties, including internal ID, email, name, locale, preferences, space, plan, billing, registration, credit and timing dimensions. Google Analytics receives preview-compatible site visits and business events, cleaned page/referrer URLs, and only internal/user ID, plan, billing interval, subscription status, language and registration date; email is sent to Google only as Enhanced Conversions while Marketing is enabled. PostHog may also evaluate feature flags and eligible heatmaps. On YouMarketing, project-controlled session replay runs under Analytics with inputs masked, sensitive routes and containers excluded, replay URLs stripped of query and hash, and no console, network body/header, canvas or cross-origin iframe capture; replay is retained for no more than 30 days. YouHome does not record replay. Browser Sentry remains disabled until verified and disclosed. Ordinary text on public pages may remain visible in a recording.

When Marketing is effectively enabled—by explicit choice in strict regions or by the regional default elsewhere—Google Ads may store click identifiers and receive conversions, Enhanced Conversions may receive a normalized email, and FirstPromoter may store referral identifiers and receive a referral email. GPC always disables this category. Marketing state remains separate from a necessary invitation code.

Our providers may process information in Singapore, the United States, the European Economic Area and other countries where they or their subprocessors operate. Those countries may have different data-protection laws. Where required, we use an approved transfer mechanism and contractual, organizational and technical safeguards. Provider terms and privacy information are available from Supabase, Cloudflare, Google, PostHog, FirstPromoter and, if enabled after verification, Sentry.

Release requires contractual and configuration confirmation that PostHog acts only as a processor/service provider. If that cannot be verified, GPC will also disable PostHog Analytics and session replay.

YouTube videos use YouTube’s privacy-enhanced domain and load only after you choose to play them. Cloudflare Stream supplies other videos; on some pages its player may load when the page renders or autoplay. External media is disclosed here but is not controlled by the Functional toggle in this version. We have not yet verified whether Cloudflare Stream uses optional player analytics or identifiers in production; that scan and legal review are release gates. A provider may receive connection and device information when a request begins, including on page load. If the scan finds non-essential storage before a play action, we will configure a no-tracking mode, place the media behind consent, or stop loading it; we will not classify optional tracking as necessary.

The register states the maximum intended lifetime in the browser. An explicit choice lasts 180 days and ordinary visits do not renew it. Analytics identifiers are limited to 180 days, Google Ads attribution to 90 days, FirstPromoter identifiers to 60 days, and FirstPromoter details to one day. ym_privacy_regime is a session cookie with a maximum logical trust of 12 hours. Session values normally end with the session. Security and authentication values last only as long as needed to provide or protect the requested service. YouMarketing session replay is retained for no more than 30 days; other provider events follow the verified production configuration.

Analytics uses the full preview-compatible model described above, not a minimal property allowlist. Page and referrer URLs are cleaned but may retain a non-sensitive query. The global safety boundary removes credentials and clearly private source content. Consent-control actions are not sent as analytics events.

Use Manage cookie settings below or Cookie settings in the footer at any time. In opt-out regions, tracking may already have run before an explicit choice. When you disable a category, we persist and broadcast the new choice, synchronously stop and reset affected providers, clear known identifiers, and reload if needed to remove an executed script. The change stops future collection and transmission; historical data already sent to a provider is not automatically deleted and may remain for the disclosed retention period unless law or a valid deletion request requires removal.

The choice is shared between YouHome and YouMarketing only on the same hostname and browser. It is not automatically synchronized to another device, browser, environment, or direct hosting-provider alias. Browser controls can also block or remove storage, but blocking necessary technologies may affect requested functions.

Depending on where you live, you may have rights to access, correct, erase, restrict or object to processing, and to receive portable data or complain to a supervisory authority. You may withdraw consent at any time without affecting processing that was lawful before withdrawal. Contact [email protected] to exercise a right. We may need to verify your identity.

We may update this policy when technology, providers or legal obligations change. The date above identifies the current version. A material change may increment the preference version and show the controls again: strict regions will require prior consent, while other regions will use the disclosed regional opt-out mode. Editorial corrections do not reset your choice. Send questions to MIND MOTOR PTE. LTD. at [email protected].