Cookie Policy
Last Updated: October 27, 2026
Version: 1.3.1
Effective Date: February 20, 2026
1. Introduction
This Cookie Policy explains how Jollido (formerly SocialNext; "we," "us," "our") uses cookies and similar tracking technologies on our website and application at https://jollido.app ("Service").
Related Policies:
- Privacy Policy - For information about data collection and processing
- Terms of Service - For terms governing use of our Service
2. What Are Cookies?
2.1 Definition
Cookies are small text files stored on your device (computer, tablet, smartphone) when you visit a website. They help websites remember your preferences and improve your experience.
2.2 Cookie Types
By Duration:
- Session Cookies: Temporary cookies deleted when you close your browser
- Persistent Cookies: Remain on your device for a set period or until manually deleted
By Source:
- First-Party Cookies: Set by us (MentalNext Ltd)
- Third-Party Cookies: Set by external services (e.g., payment processors, analytics providers)
2.3 Similar Technologies
We may also use similar technologies:
- Local Storage: Browser storage for larger amounts of data
- Session Storage: Temporary storage cleared when browser tab closes
- IndexedDB: Structured data storage in your browser
- Web Beacons/Pixels: Tiny images tracking page views and user actions
3. Cookies We Use
3.1 Essential Cookies (No Consent Required)
These cookies are strictly necessary for the Service to function. You cannot opt out of these cookies.
Legal Basis: Necessary for service delivery (GDPR Article 6(1)(b), ePrivacy Directive exemption)
| Cookie/Storage Name | Purpose | Duration | Provider | Storage Type |
|---|---|---|---|---|
sb-[project]-auth-token | Supabase authentication session | Session/Persistent | Supabase | localStorage |
supabase.auth.token | Backup auth session data | Session/Persistent | Supabase | localStorage |
user_consent | Cookie consent preferences | 1 year | Jollido | localStorage |
session_id | Anonymous session tracking (pre-login) | Session | Jollido | Generated UUID |
consent_session_id | Session identifier for consent tracking | Persistent | Jollido | localStorage |
email_capture_session_id | Session identifier for email capture flows | Session | Jollido | sessionStorage |
| JWT tokens | Authentication tokens (in memory/sessionStorage) | Short-lived (< 1 hour) | Supabase | sessionStorage |
Note: We use localStorage and sessionStorage rather than traditional cookies for most session management. These are covered by the same legal requirements as cookies under GDPR and ePrivacy Directive.
Implementation Details:
- Authentication managed by Supabase (
@supabase/supabase-jsclient library) - Consent tracking implemented in
src/contexts/ConsentContext.tsx - Session IDs generated using UUID v4 for anonymous users
Note: Supabase authentication cookies are essential for secure login and cannot be disabled.
3.2 Analytics Cookies (Consent Required)
These cookies help us understand how users interact with our Service to improve functionality and user experience.
Legal Basis: Consent (GDPR Article 6(1)(a), ePrivacy Directive)
| Cookie Name | Purpose | Duration | Provider |
|---|---|---|---|
analytics_session_id | Track page views and user paths | Session | MentalNext Ltd (sessionStorage) |
feature_usage | Track feature usage patterns | 90 days | MentalNext Ltd |
user_segment | Anonymized user segmentation | 1 year | MentalNext Ltd |
_ga | Distinguish unique users (GA4) | 2 years | Google LLC |
_ga_* | Maintain session state (GA4) | 2 years | Google LLC |
Data Collected:
- Pages visited
- Time spent on pages
- Features used
- Device type and browser
- Anonymized/truncated IP address (last octet removed)
Purpose:
- Understand user behavior patterns
- Identify popular features and content
- Detect and fix usability issues
- Make informed product decisions
Your Control: You can opt out via our cookie consent banner or Privacy Settings.
3.3 Functional Cookies (Consent Required)
These cookies enable enhanced functionality and personalization.
Legal Basis: Consent (GDPR Article 6(1)(a))
| Cookie Name | Purpose | Duration | Provider |
|---|---|---|---|
survey_${n}_answers | Store survey answers per survey number | 30 days | MentalNext Ltd |
survey_progress | Track overall survey completion progress | 30 days | MentalNext Ltd |
user_email | Remember user email for pre-fill | 1 year | MentalNext Ltd |
exercise_progress_cache | Cache exercise completion status | 7 days | MentalNext Ltd |
calendar_view | Remember calendar view preference | 1 year | MentalNext Ltd |
Your Control: You can opt out via our cookie consent banner. Disabling these may affect Service functionality.
3.4 Marketing Cookies (Not Currently Used)
Current Status: We do NOT currently use marketing or advertising cookies.
Future Use: If we decide to use marketing cookies in the future:
- We will update this policy and notify users
- Explicit opt-in consent will be required
- You will be able to opt out at any time
4. Third-Party Cookies
4.1 Current Third-Party Services
We work with the following third-party services that may set cookies:
Stripe (Payment Processing)
Provider: Stripe, Inc.
Purpose: Secure payment processing
Cookies: Stripe may set cookies to prevent fraud and manage checkout sessions
Privacy Policy: https://stripe.com/privacy
Control: Stripe cookies are essential for payment functionality; they cannot be disabled if you make a payment
Supabase (Backend Infrastructure)
Provider: Supabase, Inc.
Purpose: Authentication and database access
Cookies: Authentication tokens, session management
Privacy Policy: https://supabase.com/privacy
Control: Essential for Service functionality; cannot be disabled
Google Vertex AI (AI Processing)
Provider: Google LLC
Location: European Union (EU multi-region)
Purpose: AI-powered feedback generation using Google Gemini models via Vertex AI
Cookies: Vertex AI processes data server-side and does not set cookies directly in your browser
EU Data Residency: All AI processing occurs within the EU, ensuring your data never leaves the European Economic Area
Privacy Policy: https://cloud.google.com/vertex-ai/docs/generative-ai/learn/data-governance
Control: AI features can be opted out by not using feedback/recommendation features
Sentry (Error Monitoring)
Provider: Functional Software, Inc.
Purpose: Error tracking and performance monitoring
Cookies: May set cookies to track error sessions
Privacy Policy: https://sentry.io/privacy
Control: These are functional cookies that can be opted out via consent settings
Google Analytics 4 (Website Analytics)
Provider: Google LLC
Measurement ID: G-V3R2PDL2HY
Purpose: Website analytics (consent-gated via Consent Mode v2)
Cookies: _ga, _ga_* (set only after user consent is granted)
Privacy Policy: https://policies.google.com/privacy
Control: Analytics cookies are only set after you grant consent via our cookie banner. You can withdraw consent at any time via Privacy Settings.
4.2 No Third-Party Advertising
We do not use:
- Facebook Pixel
- Third-party advertising networks
- Behavioral tracking for advertising purposes
5. Your Cookie Choices and Controls
5.1 Cookie Consent Banner
When you first visit our Service, a cookie consent banner appears allowing you to:
- Accept All: Consent to all cookies including analytics and functional
- Reject Non-Essential: Only essential cookies will be used
- Customize: Choose specific cookie categories
5.2 Privacy Settings
You can change your cookie preferences anytime:
- Go to My Data & Privacy → Privacy Settings
- Toggle cookie categories on/off
- Save your preferences
Changes take effect immediately.
5.3 Browser Controls
Most browsers allow you to:
- View cookies stored on your device
- Delete existing cookies
- Block all cookies (may break website functionality)
- Block third-party cookies only
Browser Cookie Settings:
- Chrome: Settings → Privacy and security → Cookies
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Preferences → Privacy → Cookies
- Edge: Settings → Privacy → Cookies
Note: Blocking all cookies will prevent you from using our Service, as authentication requires essential cookies.
5.4 Do Not Track (DNT)
Some browsers support "Do Not Track" signals. Currently, there is no industry standard for responding to DNT signals. We respect your privacy choices made through our consent banner and privacy settings.
5.5 Mobile Devices
On mobile browsers:
- iOS Safari: Settings → Safari → Block All Cookies
- Android Chrome: Settings → Site settings → Cookies
6. Data Retention
| Cookie Category | Retention Period | After Deletion |
|---|---|---|
| Essential Cookies | Session to 7 days | Re-created on next login |
| Analytics Cookies | 30-90 days | Analytics tracking stops |
| Functional Cookies | 7 days to 1 year | Preferences reset to defaults |
Withdrawal of Consent:
- Deleting cookies removes them from your device immediately
- Changing consent settings prevents future cookies from being set
- Previously collected data is subject to our Privacy Policy retention periods
7. Legal Basis for Cookie Use
7.1 Essential Cookies
Legal Basis: Necessary for contract performance (GDPR Article 6(1)(b)) and exempt from consent requirements under ePrivacy Directive.
Justification: Required for:
- User authentication and security
- CSRF protection
- Session management
- Basic Service functionality
7.2 Non-Essential Cookies
Legal Basis: Consent (GDPR Article 6(1)(a))
Consent Requirements:
- Freely given, specific, informed, and unambiguous
- Obtained before cookies are set
- Withdrawable at any time
- Granular (per cookie category)
8. International Users
8.1 EEA/UK Users
For users in the European Economic Area (EEA) and United Kingdom:
- We comply with GDPR and ePrivacy Directive
- Consent is required for non-essential cookies
- You have the right to withdraw consent anytime
- Cookies are subject to data protection rights (access, deletion, portability)
8.2 California Users
For California residents under CCPA/CPRA:
- Cookies may be considered "personal information"
- You have the right to know what cookies are used
- You can opt out of "sale" or "sharing" of data (we do not sell or share data)
8.3 Other Jurisdictions
We aim to comply with cookie laws in all jurisdictions where we operate. Specific requirements may apply based on your location.
9. Children's Privacy
We do not knowingly collect data from children under 13 via cookies. If you believe a child has consented to cookies, please contact us at olli@mentalnext.com.
10. Updates to This Cookie Policy
10.1 Policy Changes
We may update this Cookie Policy to reflect:
- Changes in cookies used
- New features or services
- Changes in legal requirements
- Changes in third-party services
10.2 Notification
- Material Changes: 30 days' notice via email and in-app notification
- Minor Changes: Updated "Last Updated" date
- New Cookie Categories: New consent request via banner
10.3 Version History
Previous versions are archived and available upon request at olli@mentalnext.com.
11. Contact Us
Questions about our use of cookies?
Company: MentalNext Ltd
Email: olli@mentalnext.com
My Data & Privacy: https://jollido.app/my-data
12. Additional Resources
12.1 Learn More About Cookies
- All About Cookies: https://www.allaboutcookies.org/
- EU Cookie Law: https://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm
- ICO Guidance (UK): https://ico.org.uk/for-organisations/direct-marketing-and-privacy-and-electronic-communications/guide-to-pecr/cookies-and-similar-technologies/
12.2 Our Other Policies
- Privacy Policy - How we handle your personal data
- Terms of Service - Terms governing Service use
Acknowledgment
By clicking "Accept" on our cookie banner or continuing to use the Service after dismissing the banner, you consent to our use of cookies as described in this policy.