Cookie notice

This Cookie and Analytics Notice explains how Ghost Pixel Studios LLC ("Ghost Pixel," "we," "us," or "our") uses cookies, local storage, session storage, software development kits ("SDKs"), and similar technologies in connection with Hey Pepper, including its website, web application, browser extension, and related services (collectively, the "Service").

This notice supplements our Privacy Policy. If this notice conflicts with the Privacy Policy, the Privacy Policy controls regarding our handling of personal information.

1. What these technologies are

Cookies are small text files placed on a browser or device. Local storage and session storage allow a website or application to store information in a browser. SDKs and similar technologies may collect events and device or usage information directly from the Service.

These technologies can recognize a browser or session, keep you signed in, remember settings, protect the Service, understand how features are used, and help diagnose technical problems.

2. Categories we use

Strictly necessary technologies

We use strictly necessary cookies and storage to:

• authenticate users and maintain secure sessions;
• prevent fraud, abuse, and unauthorized access;
• route requests and maintain basic Service functionality;
• remember security, privacy, and consent choices;
• operate account, subscription, billing, and requested features; and
• preserve settings needed for the Service to function.

These technologies are required to provide the Service or a feature you request. They are active without analytics consent. Blocking them through browser settings may prevent sign-in, account management, billing, preferences, or other core features from working correctly.

Our authentication and billing provider, Clerk, and other infrastructure providers may set or use necessary technologies when providing their services.

Optional analytics and session replay

Only after you choose Accept analytics, we use PostHog for product analytics, diagnostics, and session replay. We use this information to understand feature usage, identify errors and confusing interactions, evaluate product changes, respond to support issues, and improve the Service.

PostHog analytics may collect:

• a pseudonymous or account identifier;
• your name and email address after you sign in;
• device, browser, operating-system, language, screen, and approximate location information;
• IP address and network information, subject to our PostHog configuration;
• page or screen views, referring and destination URLs, timestamps, and session information;
• clicks, navigation, scrolling, and feature interactions;
• subscription tier and product-usage events;
• errors, performance information, and diagnostics; and
• your analytics-consent status.

We do not use PostHog for third-party advertising or cross-context behavioral advertising.

3. Session replay

Session replay creates a visual reconstruction of interactions with the Service, such as clicks, scrolling, navigation, and interface changes. It helps us understand problems that can be difficult to reproduce from an error report alone.

Session replay begins only after you accept analytics. We configure it to:

• mask all input fields;
• exclude or block AI chats, voice transcripts, recipe notes, user-uploaded images, names, email addresses, and other sensitive content;
• exclude authentication, billing, account-management, and account-deletion screens;
• redact sensitive URL query parameters;
• avoid capturing unreviewed network request or response bodies and console content; and
• retain recordings for 30 days.

We do not intend to collect passwords, payment-card details, authentication tokens, chat contents, voice transcripts, recipe notes, user images, or sensitive health information through replay. Please contact us promptly if you believe a recording may have captured protected information.

Access to session replay is limited to authorized personnel who need it for product improvement, debugging, security, or support.

4. Your analytics choice

Optional analytics and session replay are off unless you accept them. You may:

• accept analytics;
• decline analytics;
• continue using core Service features after declining; and
• change your choice later through Settings.

If you decline or withdraw consent, we stop future PostHog analytics and session-replay capture on the applicable account or device. Withdrawing consent does not automatically delete information collected before withdrawal. Previously collected session recordings expire within 30 days, and other analytics information is handled according to the Privacy Policy and our provider settings. You may contact us to request deletion where applicable.

Your choice may be stored in a necessary cookie or browser storage so we can remember it. If you clear browser storage, change browsers or devices, use a private-browsing session, or sign out, we may need to ask again.

You can also control cookies through browser settings. Browser controls may not affect local storage, SDK collection, or previously stored data, and blocking necessary technologies may impair the Service.

5. Technology inventory

The exact names and expiration periods can vary based on provider configuration and may change as the Service evolves. The following inventory must be verified against the production Service before publication.

We will update this notice if we introduce a materially different category or purpose.

6. PostHog

PostHog processes optional analytics and replay information for us as a service provider. PostHog's privacy controls operate in the browser so properly masked content is redacted before it is sent to PostHog.

We will opt out of PostHog's use of Hey Pepper Customer Content for PostHog product and model development before enabling analytics for customers. PostHog's own privacy practices are described in its Privacy Policy (https://posthog.com/privacy).

7. No advertising sale or sharing

We do not use third-party advertising cookies. We do not sell personal information or share it for cross-context behavioral advertising or targeted advertising.

Because there is no universally accepted browser "Do Not Track" standard, the Service uses the analytics-consent and Settings controls described above. Where applicable, we recognize legally required opt-out preference signals for activities covered by those signals. Because we do not sell or share personal information for targeted advertising, those signals do not otherwise change that practice.

8. Changes to this notice

We may update this notice as our technology, providers, or legal obligations change. We will post the updated version with a revised effective date. If a change materially expands optional data collection, we will provide notice and request consent where required before beginning the expanded collection.

9. Contact us

Questions or requests concerning cookies, analytics, or session replay may be sent to:

Ghost Pixel Studios LLC Email: [email protected] Mailing address: 21750 Hardy Oak Blvd Ste 104, PMB 72445, San Antonio, Texas 78258-4946 US