Cookie Policy — Me Journal
Last updated: 2026-07-07 Effective date: to be set when published
1. What this policy covers
This policy explains:
- What cookies and similar technologies we use
- What each one does
- How long they last
- How you can control them
It is a companion to our Privacy Policy.
2. What is a cookie?
A cookie is a small text file that a website stores on your device when you visit. It lets the site remember things between visits — for example, that you're logged in.
We also use similar technologies:
- Local storage / session storage — like cookies but stored by your browser instead of sent with each request
- IndexedDB — used to store larger items on your device, like meditation audio for offline playback and an offline copy of your recent entries and pending writes (journal content in this cache stays encrypted)
- Service worker — runs in the background to keep the installed app on the latest version; it can also show notifications if you opt in to reminders, but reminders are not yet live and no notifications are currently sent
For simplicity, we refer to all of these as "cookies" in this policy unless we need to be specific.
3. The cookies we use
3.1 Strictly necessary cookies
These cookies are essential for the Service to work, or store choices you make explicitly in the app (like dismissing a prompt or collapsing the sidebar). They do not require consent under UK PECR or the EU ePrivacy Directive.
| Cookie / storage | Set by | Purpose | Duration |
|---|---|---|---|
| __session, __client_uat and related __clerk_* cookies | Clerk | Keep you signed in across pages and tabs | Session / up to 1 year |
| mj_session_expires_at | Me Journal | Cap how long a signed-in session lasts on this device (7 days in a browser tab, 14 days in the installed app) | 7–14 days |
| sidebar_state | Me Journal | Remember whether you collapsed the dashboard sidebar | 7 days |
| mj_onboarded_at | Me Journal | Short-lived hand-off flag while onboarding completes | 5 minutes |
| mj-install-prompt-* | Me Journal | Remember that you dismissed the "install app" prompt so we don't show it repeatedly | Persistent (localStorage) |
| mj-cookie-consent-v1 | Me Journal | Record your cookie-consent choice so we don't re-ask on every visit | Persistent (localStorage) |
| mj_vault_autolock, mj_session_remember_me | Me Journal | Per-device preferences: vault auto-lock timing and your "remember me" choice | Persistent (localStorage) |
| mj_intended_plan, mj_onboarding_in_session | Me Journal | Short-lived flags used while sign-up and onboarding complete | Until the tab closes (sessionStorage) |
| Service worker registration | Me Journal | Keep the installed app on the latest version. It can show reminder notifications if you opt in, but reminders are not yet live — no notifications are currently sent | Persistent until you uninstall the PWA |
| IndexedDB caches (mj_audio_cache, mejournal-offline) | Me Journal | Store downloaded meditation audio for offline playback, plus an offline copy of recent entries and pending writes — journal content in this cache stays encrypted | Persistent until you clear browser data |
3.2 Analytics (only with your consent)
| Technology | Set by | Purpose | Duration | |---|---|---|---| | Vercel Web Analytics script | Vercel | Count page views in aggregate for product improvement; pseudonymous; no cross-site tracking. This tool is cookieless — it sets no cookies and stores nothing on your device | No cookies or device storage |
We only load the analytics script after you choose Accept all in the cookie banner — wherever you are in the world, not just the EU/EEA or UK. If you reject, or your browser sends a Global Privacy Control signal, the script never loads. Some recent UK reforms (DUAA 2025) signal that low-impact analytics may be permitted without consent in future; we err on the strict side until that's settled.
Even when you have consented, we never send analytics events for pages relating to your journal, gratitude, Body Compass, PMS tracking, SOS or other health-related areas — those page views are dropped on your device before anything is sent to Vercel.
3.3 Payment cookies (set only when you check out)
| Cookie / storage | Set by | Purpose | Duration |
|---|---|---|---|
| Stripe checkout cookies (e.g. __stripe_mid, __stripe_sid) | Stripe | Run the secure embedded checkout flow; fraud detection | Session / up to 1 year |
These are set only when you go through Stripe checkout. They are strictly necessary for the payment, so they don't require separate consent under PECR.
3.4 No advertising / tracking cookies
We do not use:
- Google Analytics
- Facebook Pixel
- Google Ads conversion pixels
- LinkedIn Insight Tag
- TikTok Pixel
- Any other behavioural advertising or cross-site tracking technology
If you've used third-party tools to identify cookies on a website (e.g. EditThisCookie, browser DevTools), and you see something here that's not in this list, please email privacy@me-journal.com — that would be something we should fix.
4. How we ask for consent
4.1 EU/EEA users
When you first visit the website, we show a cookie banner that:
- Explains what cookies do (the brief version) with a link to this policy
- Offers two clearly equal-prominence options: Accept all and Reject non-essential
- Sets only strictly necessary cookies until you choose
- Allows you to change your choice at any time via a "Cookie Preferences" link in the footer
Closing the banner without choosing means only strictly necessary cookies are set — closing is not consent.
4.2 UK users
Same approach as EU/EEA. The UK is moving toward more permissive rules for low-impact analytics cookies under the Data (Use and Access) Act 2025, but until ICO publishes finalised guidance, we apply the stricter standard.
4.3 California users
We honour Global Privacy Control (GPC) signals from your browser as a valid opt-out request. When we detect the signal, we automatically record a "reject non-essential" choice and show you an on-screen confirmation at the time.
We don't sell or share personal information for cross-context behavioural advertising, so the "Do Not Sell or Share My Personal Information" right is, for us, automatic — there is nothing to opt out of. You can review or change your cookie choice at any time via the Cookie Preferences link in the footer.
4.4 Other regions
If your jurisdiction's law doesn't require explicit opt-in, we use a soft consent model — show the banner, set non-essential cookies only after you click Accept. Functionally the same as the EU model.
5. How to change your cookie preferences
Within Me Journal:
- Click Cookie Preferences in the footer
In your browser:
Chrome
Settings → Privacy and security → Cookies and other site data → See all site data and permissions → search for "me-journal.com" → remove or block
Safari (macOS)
Safari → Settings → Privacy → Manage Website Data → search for "me-journal.com" → Remove
Safari (iOS)
Settings → Safari → Advanced → Website Data → search for "me-journal.com" → swipe to delete
Firefox
Settings → Privacy & Security → Cookies and Site Data → Manage Data → search for "me-journal.com" → Remove
If you delete cookies, you'll be signed out. To use the Service, you'll need to allow at least the strictly necessary cookies.
6. Cookies and the Service we provide
If you reject all non-essential cookies:
- The Service still works — the strictly necessary cookies are enough to run it
- We can't measure aggregate usage (but that's fine; aggregate usage isn't required for any feature)
- Your privacy is identical or stronger
If you delete strictly necessary cookies:
- You will be signed out
- The app will treat you as a new visitor
7. Changes to this policy
When we add or change cookies materially, we update this page and notify you via the cookie banner so you can re-consent if needed.
Earlier versions of this policy are available on request — email privacy@me-journal.com.
8. Contact
- Cookie or tracking questions: privacy@me-journal.com
- Lead supervisory authority: Information Commissioner's Office (ICO) — https://ico.org.uk
- EU/EEA users: you may also lodge a complaint with your own national data protection supervisory authority.