Manage Cookie Preferences
Choose which optional cookies Addison's Diary may use. Necessary cookies are always on.
ADDISON'S DIARY
Cookie Policy
Pribco LLC · addisonsdiary.com
Effective June 21, 2026 · Version 4.5 · USA Only
Addison’s Diary · Cookie Policy · Pribco LLC
ADDISON’S DIARY
Cookie Policy
Pribco LLC · addisonsdiary.com
| THE SHORT VERSION |
|---|
| When you visit addisonsdiary.com, a cookie consent banner appears before any |
| non-essential cookies or tracking scripts load. Nothing fires until you accept. |
| If you accept, the following are active on the public landing page only: |
| Meta Pixel (_fbp, _fbc) — advertising and retargeting on public pages |
| Google reCAPTCHA — may be used for bot protection in the future |
| If you decline, only strictly necessary cookies are set. |
| None of these marketing tools ever load inside the app or on any |
| page where health or care information is present. |
| NEW IN VERSION 4.2: Added Meta Pixel. Google reCAPTCHA and Rewardful noted as future-use. |
| Switched SMS provider from AWS End User Messaging to Twilio. |
| We do NOT use advertising cookies or tracking inside the app. |
| We do NOT sell your cookie data or share it with advertisers. |
| Health and care data is never transmitted to Meta or Google. |
| Rewardful affiliate tracking may be used in the future — no health data will ever be shared. |
Google Analytics
Addison’s Diary uses Google Analytics cookies on the web version of the platform to understand how visitors interact with the site. Google Analytics cookies collect anonymised information about page views, session duration, and general usage patterns. This data is used solely to improve the platform experience. Google Analytics cookies are set only after you accept the cookie consent banner and are never loaded inside the authenticated app or on any page where health or care data is present. For more detail see Category 3 (Analytics) below.
Cookie Preferences
You can manage your optional cookie preferences at any time using the preference center at addisonsdiary.com/cookies. When you first visit the site, a consent banner appears before any non-essential cookies or tracking scripts load — nothing fires until you make a choice. Necessary cookies are always on and cannot be disabled. The following optional categories can be enabled or disabled:
- Functional — remember your preferences
- Marketing — Meta Pixel (_fbp, _fbc) for advertising and retargeting on the public landing page
- Marketing — Google Ads conversion tag (_gcl_au) for ad conversion measurement on the public landing page
- Affiliate Referral Tracking — Rewardful may be used in the future for referral credit
- Security/Functional — Google reCAPTCHA may be used for bot protection in the future
1. What This Policy Covers
This Cookie Policy explains what cookies and similar technologies Addison’s Diary uses, why we use them, and how you can control them. It applies to the Addison’s Diary website and web application at addisonsdiary.com and any Progressive Web App (PWA) version of the application. The Meta Pixel operates only on the public landing page and does not load inside the authenticated application or on any page where health or care information is present. Google reCAPTCHA and Rewardful are not currently active but may be used in the future; this policy will be updated before either is activated.
This policy should be read together with our Privacy Policy (addisonsdiary.com/privacy), Terms of Use (addisonsdiary.com/terms), Platform Disclaimer (addisonsdiary.com), Acceptable Use Policy (addisonsdiary.com), HIPAA Notice and Health Data Policy (addisonsdiary.com/health-data), and Data Deletion and User Rights Policy (addisonsdiary.com), all of which are incorporated herein by reference. In the event of any conflict between these documents, the order of precedence is: Terms of Use, Acceptable Use Policy, Data Deletion and User Rights Policy, HIPAA Notice and Health Data Policy, Privacy Policy, then Cookie Policy. For information about how cookie data interacts with your privacy rights, see Privacy Policy Section 9 (Cookies). For deletion rights that extend to cookie and browser storage data, see the Data Deletion and User Rights Policy. For the confirmation that cookies and browser storage never contain health information, see HIPAA Notice and Health Data Policy Section 4. For SMS consent and communications terms, see Terms of Use Section 8.
2. What Cookies Are
Cookies are small text files that a website places on your device when you visit. They are widely used to make websites work, remember your preferences, and provide information to site owners. In addition to cookies, websites may use similar technologies including:
- Local storage — browser-side storage for larger data items that persists until explicitly cleared
- Session storage — browser-side storage that is cleared when you close your browser tab
- IndexedDB — a browser database for offline-capable web applications
References to “cookies” in this policy include all similar technologies unless otherwise specified.
3. Cookie Categories We Use
Category 1 — Strictly Necessary
| These cookies are essential for the application to function. |
|---|
| They cannot be disabled without breaking the application. |
| They do not require your consent. |
| They are always active. |
Strictly necessary cookies and storage include the tokens and session data that keep you signed in, security tokens that protect against cross-site attacks, and the data your browser stores locally to make the application responsive and fast. Without these, the application cannot function.
| Cookie / Storage Key | Type | Purpose | Duration | Required? |
|---|---|---|---|---|
| CognitoIdentityServiceProvider.* | Session / Local Storage | Authentication tokens. Keeps you signed in. Contains your JWT access, ID, and refresh tokens. | Session / Until sign-out | Required |
| amplify-signin-with-hostedUI | Local Storage | Tracks whether you signed in through Cognito Hosted UI. Used for sign-out flow. | Session | Required |
| amplify-redirected-from-hosted-ui | Session Storage | Temporary flag used during OAuth redirect flow to prevent redirect loops. | Session only | Required |
| familyId | Local Storage | Stores your family account identifier locally for fast app initialization. | Until sign-out | Required |
| addisonsdiary_cookie_consent | Local Storage | Records your cookie consent choice so the banner does not appear on every subsequent visit after you have accepted on your first visit. | Until you change it, we update this policy, or you clear cookies from your local storage cache | Required |
Category 2 — Functional
| These cookies remember your preferences and improve your experience. |
|---|
| They are not strictly required for the app to function. |
| You can opt out of these at any time. |
| Cookie / Storage Key | Type | Purpose | Duration | Required? |
|---|---|---|---|---|
| addisonsdiary_prefs | Local Storage | Stores your in-app display preferences and notification settings locally for faster rendering. | Until cleared or sign-out | Optional |
| addisonsdiary_checklist_dismissed | Local Storage | Remembers whether you have dismissed the Getting Started onboarding checklist. | Persistent | Optional |
| addisonsdiary_last_section | Session Storage | Remembers which section of the app you were viewing, so returning to the app lands you in the right place. | Session only | Optional |
Category 3 — Analytics
| These cookies help us understand how the public landing page is being used. |
|---|
| All analytics data is anonymized or aggregated. |
| These cookies never load inside the authenticated app. |
| You can opt out of these at any time. |
Category 4 — Marketing (Meta Pixel and Google Ads)
| These cookies are set by Meta on the public landing page when you accept cookies. |
|---|
| They are used for advertising, retargeting, and ad optimization. |
| They operate ONLY on the public landing page — never inside the app. |
| No health or care data is ever transmitted to Meta via these cookies. |
| Under CCPA/CPRA, sharing data via these cookies is treated as |
| 'sharing for cross-context behavioral advertising'. |
| You can opt out by declining cookies or using the Cookie Preferences center. |
| You can also opt out at facebook.com/privacy/policies/cookies. |
| Google Ads also sets first-party cookies (such as _gcl_au) on the public landing page when you accept cookies. |
| They are used ONLY to measure ad conversions (a signup attributed to an ad) — not for remarketing or to build audiences. |
| They operate ONLY on the public landing page — never inside the app, and no health or care data is transmitted to Google. |
| You can opt out by declining cookies or using the Cookie Preferences center, or at policies.google.com/technologies/cookies. |
Category 5 — Affiliate Referral Tracking (Rewardful)
| Addison's Diary does not currently use Rewardful. Rewardful may be activated in the future to operate an affiliate partner program. |
|---|
| When you arrive at addisonsdiary.com via an affiliate partner link, |
| If activated, Rewardful would place a referral tracking cookie on your browser. |
| This cookie records ONLY which affiliate partner referred you, |
| so that partner can receive commission credit if you subscribe. |
| This cookie does NOT track your browsing behavior across other websites. |
| This cookie does NOT contain or access any of your health or care information. |
| This cookie is NOT used for advertising or behavioral profiling of any kind. |
| Cookie / Storage Key | Type | Purpose | Duration | Required? |
|---|---|---|---|---|
| rewardful_referral | Cookie / Local Storage | Records which affiliate partner referred you to addisonsdiary.com. Used solely to credit the referring partner if you subscribe. | 60 days | Optional |
| via (URL parameter) | URL parameter only | Identifies the affiliate in the referral link. Processed at page load and stored in the referral cookie. Not stored independently. | Session (URL only) | Optional |
Category 6 — Security / Functional (Google reCAPTCHA)
| Google reCAPTCHA is not currently active on addisonsdiary.com. If activated in the future, it would be used for bot protection on the landing page. |
|---|
| It runs invisible bot detection when you submit the pop-up form. |
| It does NOT load inside the authenticated app. |
| It shares behavioral signals and IP address with Google for bot scoring. |
| Subject to cookie consent — does not load unless you accept. |
| Cookie / Storage Key | Type | Purpose | Duration | Required? |
|---|---|---|---|---|
| _GRECAPTCHA | Third-party cookie (Google) | Bot detection on the landing page. Behavioral signals and IP address shared with Google. Not currently active — may be used in the future. | ~6 months | Optional (loads with pop-up after consent) |
| _tccl_visitor | Third-party cookie (GoDaddy hosting) | Host-level visitor identifier set by GoDaddy infrastructure. Not controlled by Pribco LLC. No health or care data. Pribco LLC has no access to data from this cookie. | Varies | Required (set by host) |
4. Third-Party Cookies
Addison’s Diary uses the following third-party services that may set cookies or use browser storage. The Meta Pixel operates on the public landing page and never inside the authenticated app. Google reCAPTCHA and Rewardful are not currently active but may be used in the future. GoDaddy, as the web hosting provider for addisonsdiary.com, may set a host-level cookie (_tccl_visitor) on visitors’ browsers. This cookie is set by GoDaddy’s infrastructure, is not controlled by Pribco LLC, and carries no health or care data.
Meta (Facebook Pixel)
Role: Advertising, retargeting, and ad optimization on the public landing page. Meta technology operates through two mechanisms: the browser-based Meta Pixel, which fires on public landing page views; and the server-side Meta Conversions API, which sends two billing events server-to-server — StartTrial (when a free trial begins) and Subscribe (when the first charge clears). The Subscribe event includes the subscription charge amount and currency (e.g., $19.99 USD) and a one-way hashed (SHA-256) version of the account email; it includes no name, contact details, health, or care data. Scope: Landing page and billing events only — never inside the authenticated app. No health or care data is ever transmitted to Meta. Data controller: Meta acts as an independent data controller for Pixel and Conversions API data. Privacy: facebook.com/privacy/policy
Google Ads (Conversion Measurement)
Role: Measuring ad conversions on the public landing page. When a visitor arrives from a Google ad and completes a free-trial signup, the browser-based Google tag reports a single conversion event to Google Ads and sets first-party cookies (such as _gcl_au) on the public landing page to attribute the signup to the ad. Google Ads is configured for conversion measurement only — it is not used for remarketing or to build advertising audiences. Data shared: the Google click identifier, public landing-page views, the fact that a trial signup occurred, and an opaque internal reference identifier; no name, email, payment, health, or care data. Scope: Public landing page only — never inside the authenticated app. No health or care data is ever transmitted to Google. Data controller: Google acts as an independent data controller. Privacy: policies.google.com/privacy
| Cookie / Storage Key | Type | Purpose | Duration | Required? |
|---|---|---|---|---|
| _fbp | First-party cookie (Meta Pixel) | Unique browser identifier for ad tracking and retargeting. Data sent to Meta. Landing page only. | ~90 days | Optional (Marketing) |
| _fbc | First-party cookie (Meta Pixel) | Stores the ad-click identifier (fbclid) from Facebook/Instagram ads for attribution. | ~90 days | Optional (Marketing) |
| _gcl_au | First-party cookie (Google Ads) | Conversion linker — measures ad conversions (a free-trial signup attributed to a Google ad). Data sent to Google. Landing page only. | ~90 days | Optional (Marketing) |
| _gcl_aw | First-party cookie (Google Ads) | Stores the Google ad-click identifier (gclid) for conversion attribution. Landing page only. | ~90 days | Optional (Marketing) |
| fr, datr (read) | Third-party (facebook.com) | Read by Meta to match visitor to their Meta account if logged into Facebook. | Varies | Optional (Marketing) |
Addison's Diary email service (not currently active)
Role: Email capture and campaign management. Addison's Diary does not currently use Addison's Diary email service (not currently active). If Addison's Diary email service (not currently active) is activated in the future, this policy will be updated before any data is transmitted to Addison's Diary email service (not currently active). No health or care data will ever be shared with Addison's Diary email service (not currently active).
| Cookie / Storage Key | Type | Purpose | Duration | Required? |
|---|---|---|---|---|
| Removed | localStorage (Addison's Diary email service (not currently active)) | Identifies visitors who submit Addison's Diary email service (not currently active) forms. Used for pop-up display logic and form tracking. | Persistent | Optional (Functional) |
| Removed | First-party | Records whether a visitor has seen the pop-up and enforces frequency settings. | Per behavior settings | Optional (Functional) |
| Removed | First-party | Track page views, time on site, and visitor counts on the landing page. | Varies | Optional (Analytics) |
Google reCAPTCHA
Role: Bot protection on the landing page. Not currently active — may be used in the future. Not present inside the app. Google acts as an independent data controller for reCAPTCHA data. Data shared with Google: hardware/software info, IP address, behavioral signals. Privacy: google.com/privacy
Amazon Cognito (AWS)
Role: Authentication and account security inside the app. Cognito tokens are stored in local storage by the addisonsdiary.com domain — no third-party cookie. Pribco LLC is the data controller; AWS is a data processor. Privacy: aws.amazon.com/privacy
Stripe
Role: Subscription payment processing. Stripe sets its own cookies for fraud prevention on the Stripe-hosted payment domain only. Stripe acts as an independent data controller for cookies on its own domain. Privacy: stripe.com/privacy
Rewardful (Affiliate Program)
Role: Affiliate referral tracking. Pribco LLC is the data controller; Rewardful is a data processor. Data shared: referral source and subscription confirmation only. No health data. Privacy: rewardful.com/privacy
Postmark and Twilio
Role: Email and SMS delivery. These services do not set cookies on addisonsdiary.com and have no cookie presence on the application.
5. Cookie Consent
When you visit addisonsdiary.com, a cookie consent banner appears before any non-essential cookies or tracking scripts load. No marketing, analytics, or tracking technology fires until you make a choice. This means the Meta Pixel, Google reCAPTCHA, and Rewardful are all blocked until you accept.
5.1 How the Banner Works
- The banner appears before any non-essential scripts load
- Strictly necessary cookies load immediately — they are required for the page to function
- The Meta Pixel, Google reCAPTCHA, and Rewardful do not load until you click “Accept”
- If you click “Decline” or “Necessary Only,” only strictly necessary cookies are set and no marketing or tracking scripts load
- Your acceptance is required on your first visit and is stored until you change it, we update this policy, or you clear cookies from your local storage cache — the banner will not reappear on subsequent visits until then
- You can change your preference at any time via the Cookie Preferences link in the site footer
5.2 CCPA Opt-Out and GPC
Under CCPA/CPRA, sharing browsing data via the Meta Pixel is treated as “sharing for cross-context behavioral advertising.” Your right to opt out of this sharing is exercised by declining cookies on the consent banner, using the Cookie Preferences center at addisonsdiary.com/cookies, or enabling a Global Privacy Control (GPC) signal in your browser. A GPC signal overrides any prior consent and prevents all marketing and tracking scripts from loading.
6. How to Control and Delete Cookies
6.1 Change Your Preferences on Addison’s Diary
You can update your cookie preferences at any time:
- Visit addisonsdiary.com/cookies and use the preference center
- Or clear the addisonsdiary_cookie_consent item from your browser’s local storage — the consent banner will reappear on your next visit
6.2 Browser Settings
You can control cookies through your browser settings. Most browsers allow you to:
- View and delete individual cookies
- Block all cookies or block third-party cookies only
- Set cookies to expire when you close your browser
- Receive a notification when a cookie is set
Instructions for common browsers:
- Google Chrome: Settings → Privacy and Security → Cookies and other site data
- Safari: Settings → Privacy → Manage Website Data
- Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
- Microsoft Edge: Settings → Cookies and site permissions → Cookies and site data
- Samsung Internet: Settings → Privacy and security → Cookie management
Important: Blocking strictly necessary cookies will prevent you from signing in to Addison’s Diary. The application requires authentication tokens stored in local storage to function.
6.3 Local Storage and Session Storage
Cookies stored in local storage and session storage are not deleted by clearing browser cookies alone — they are managed separately. To clear local storage for addisonsdiary.com:
- Chrome / Edge: Developer Tools (F12) → Application → Local Storage → addisonsdiary.com → Right-click → Clear
- Firefox: Developer Tools (F12) → Storage → Local Storage → addisonsdiary.com → Right-click → Delete All
- Safari: Developer menu → Web Inspector → Storage → Local Storage → addisonsdiary.com
Clearing local storage will sign you out of Addison’s Diary and reset your preferences.
6.4 Do Not Track (DNT)
Addison’s Diary respects the Do Not Track (DNT) browser signal. If your browser sends a DNT:1 header, we will not set any non-essential cookies or load any analytics scripts, including affiliate tracking cookies, regardless of your cookie banner consent choice. We do not use cross-site tracking of any kind.
Important: If you previously accepted non-essential cookies via the cookie banner and subsequently enable DNT in your browser, the DNT signal will override your prior consent. Non-essential cookies will no longer load on future visits. If you later disable DNT and wish to re-enable optional cookies, turn off the signal in your browser and then re-consent via the Cookie Preferences center at addisonsdiary.com/cookies. Your prior stored consent choice is not automatically reinstated when you disable DNT.
6.5 Global Privacy Control (GPC)
The Global Privacy Control (GPC) is a browser signal that communicates your opt-out of the sale of personal information and sharing for cross-context behavioral advertising under CCPA/CPRA and other state laws. Addison’s Diary honors GPC signals. If your browser sends a GPC signal, we treat it as an opt-out of any sale or sharing of personal information for cross-context behavioral advertising — though Addison’s Diary does not sell personal information or share it for cross-context behavioral advertising in any case. As a practical matter, honoring GPC means we will not load any non-essential tracking technologies when a GPC signal is present.
Like DNT, a GPC signal overrides any prior cookie banner consent you have given. If you subsequently disable GPC and wish to re-enable optional cookies, turn off the signal in your browser and re-consent via the Cookie Preferences center at addisonsdiary.com/cookies.
7. Cookies and the Mobile App (PWA)
Addison’s Diary is a Progressive Web App (PWA) that can be added to the home screen of iOS and Android devices. When used as a PWA, the application uses the same browser-based storage mechanisms described in this policy — local storage, session storage, and browser cookies — within the PWA’s isolated browser context.
The PWA does not use native app tracking technologies such as: Apple’s App Tracking Transparency (ATT) framework, Google Advertising ID (GAID) or Apple’s Identifier for Advertisers (IDFA), mobile measurement partners or SDK-level analytics, or push notification identifiers for advertising purposes.
If Addison’s Diary is distributed as a native app through the Apple App Store or Google Play Store in the future, this policy will be updated to address any platform-specific tracking technologies. At present, the application is web-based only. Note on economic nexus: an unsettled area of law concerns whether App Store sales could affect economic nexus threshold calculations for state privacy law purposes. If a native app is published in the future, we will assess the applicable nexus and data obligations at that time and update this policy accordingly.
8. Data Stored in Cookies — What Is and Is Not There
| WHAT IS STORED IN COOKIES / LOCAL STORAGE: |
|---|
| Your authentication tokens (encrypted JWT — not your password) |
| Your family ID (an internal identifier, not personal health information) |
| Your display preferences and app settings |
| Your cookie consent choice |
| Session state for the active browser tab |
| Affiliate referral source (if you arrived via a partner link, and only if you consented) |
| WHAT IS NEVER STORED IN COOKIES / LOCAL STORAGE: |
| Your password or password hash (handled by Amazon Cognito) |
| Your care journal entries or health information |
| Your medication records or care logs |
| Your family messages or direct messages |
| Documents from your vault |
| Memory Book photos or content |
| Any personally identifiable health information of any kind |
| All family care content is stored server-side in encrypted AWS DynamoDB and S3 — never in your browser. |
9. Your Rights
California — CCPA/CPRA
California residents have the right to opt out of the sale of personal information and sharing for cross-context behavioral advertising. Addison’s Diary shares landing page browsing data with Meta via the Meta Pixel, which constitutes “sharing for cross-context behavioral advertising” under CCPA/CPRA. To exercise your right to opt out, decline cookies on the consent banner or use the Cookie Preferences center at addisonsdiary.com/cookies. Rewardful receives only referral source and subscription confirmation — not health data. To exercise other CCPA rights, contact privacyandlegal@pribco.com.
All Other US States
Residents of US states with comprehensive privacy laws (Virginia, Colorado, Connecticut, Texas, and others) have the right to opt out of targeted advertising and profiling. Addison’s Diary does not engage in targeted advertising or cross-context behavioral profiling. Affiliate tracking is limited to referral commission attribution only. The cookie controls described in Section 6 allow you to limit cookie use to strictly necessary functions.
Cookie Data and Your Broader Privacy Rights
Cookie and browser storage data forms part of your broader personal data held by Pribco LLC. Your rights to access, correct, delete, and port your data — including any data derived from or associated with cookies — are governed by the Data Deletion and User Rights Policy at addisonsdiary.com. For the full description of data categories, retention periods, and deletion timelines, see our Privacy Policy Section 7 (Data Retention and Deletion). For confirmation that cookies and browser storage never contain health-related information, see the HIPAA Notice and Health Data Policy Section 4 at addisonsdiary.com/health-data.
10. Changes to This Cookie Policy
We may update this Cookie Policy from time to time — for example, if we add new features that use cookies, engage a new analytics provider, or if applicable law changes. When we make material changes, we will:
- Update the effective date at the top of this policy
- Notify registered users by email or in-app notice
- Not introduce advertising or tracking cookies without prominent disclosure and your explicit consent
Note on version numbers: This legal document carries its own version number (the “Version” shown at the top). The cookie consent banner also carries a separate banner-consent version that may be incremented independently — for example, when a change requires re-prompting you for consent. The banner-consent version and this document version are maintained separately and may not always match; both are current.
Version 4.5 changes: Added Google Ads conversion measurement (cookies _gcl_au and _gcl_aw) to the Marketing category (Category 4) and the Third-Party Cookies section (Section 4); configured for conversion measurement only — not remarketing or audience building. Version 4.4 changes: Added Meta Pixel (_fbp, _fbc) and Google reCAPTCHA (_GRECAPTCHA) to all relevant sections. Updated cookie categories to reflect landing-page-only marketing tools. Rewrote Category 5 (was empty advertising denial; now documents Meta Pixel). Added new Category 6 (reCAPTCHA). Rewrote Section 4 Third-Party Cookies to include Meta and Google. Updated Section 5 consent to reflect forced consent-before-tracking model. Updated Section 9 CCPA to reflect Meta Pixel sharing. Switched SMS provider from AWS End User Messaging to Twilio. Version 4.0 (June 21, 2026): Removed all EU/UK and international jurisdiction content.
11. Contact
Questions about this Cookie Policy or your cookie preferences may be directed to:
Pribco LLC — Addison’s Diary
Primary Contact for All Privacy, Cookie, and Legal Requests: privacyandlegal@pribco.com
General Support (account issues, technical help): support@addisonsdiary.com
Cookie Preference Center: addisonsdiary.com/cookies
Use privacyandlegal@pribco.com as the primary channel for all privacy and cookie matters including CCPA requests and consent withdrawals. This ensures your request is routed to the appropriate team and that statutory response timeframes are met. General support inquiries that are not privacy-related may be sent to support@addisonsdiary.com.