Skip to content

Cookie Policy

Our cookie policy and how we use them

Last updated: October 6, 2026

This page lists everything harielxavier.com stores in your browser, what each item is for, how long it lasts, and how to turn the optional parts off. It is short on purpose. If anything here is unclear, email Mauricio@HarielXavier.com.

Cookies we set

Cookies are small text files a site stores on your device. We use analytics and advertising cookies from Google Analytics 4 and the Meta Pixel, two functional cookies of our own (live chat and private wedding pages), and essential security and sign-in cookies that are only set on sign-in and dashboard pages.

CookieSet byTypePurposeKept for
_ga, _ga_*Google Analytics 4Analytics / advertisingGives your browser a unique ID so GA4 can tell new visits from returning ones, see which pages couples read and where they came from, and measure our Google ads. Google receives this ID with your page views and IP address.Up to 2 years
_gcl_* (when set)Google tagAdvertisingMay be set when you arrive from a Google ad, so the visit and any inquiry can be credited to that ad.90 days
_fbp, _fbcMeta PixelAdvertisingA browser ID (_fbp) and, when you arrive from a Facebook or Instagram ad, the ad click ID (_fbc). Lets Meta measure whether our ads lead to visits and inquiries.90 days
live_chat_sessionharielxavier.comFunctionalSet by our server when you use the live chat, so your later messages are tied to your own chat and nobody else can post into it. Only sent to our chat service; not readable by scripts.30 days
wedding_access_<page>harielxavier.comFunctionalSet after you enter the password for a private wedding page, so you are not asked again on every visit. Signed and not readable by scripts.24 hours
csrfSecretharielxavier.comEssentialSecurity token that protects sign-in and dashboard forms against forged requests. Only set on sign-in and dashboard pages; the public marketing pages never set it.Until you close your browser
sb-*-auth-token (and related sb-* cookies)SupabaseEssentialKeeps you signed in to the client dashboard. Only set after you log in; the public marketing pages never set it.Session, refreshed while you stay signed in

Browser storage (not cookies)

A few features remember things using your browser’s local storage (or, where marked, session storage, which is cleared when you close the tab). Most of it never leaves your device. Two items are sent to us: the chat session ID, with your chat messages, and hx-attribution, with an inquiry. None of it is sent to a third party. Local-storage items stay until you clear your browser data.

  • live_chat_session — A random chat session ID, so the chat survives a page change. It is sent to our server with your chat messages. (Sent to us.)
  • live_chat_mode, live_chat_email_captured — Remember whether you are talking to the assistant or to Mauricio, and that you already left your email in the chat so it does not ask again.
  • hx-attribution — How you first arrived: landing page, referring site, campaign (UTM) tags and ad click IDs (gclid, fbclid), saved on your first visit. It is sent to us with an inquiry so we know which channel brought you here. (Sent to us.)
  • sticky_offer_dismissed_v2 — Remembers that you closed the offer bar so it does not reappear.
  • hx-exit-intent-shown (this tab only) — Remembers that you already saw the exit reminder so we only show it once per visit.
  • hx-lead-fired:* (this tab only) — Stops a refresh of the thank-you page from counting the same inquiry twice.
  • hx-analytics-notice-dismissed — Remembers that you dismissed the small cookie notice.
  • hx-analytics-optout — Your opt-out. When it is set, Google Analytics and the Meta Pixel are not loaded in this browser and your inquiry is not reported to Google or Meta.

How to opt out

Use the control below to stop Google Analytics and the Meta Pixel from loading in this browser. While you are opted out, an inquiry you send is also not reported to Google or Meta from our server. It works per browser and per device, and you can turn analytics back on any time from this page. The “Opt out” link in the notice shown on your first visit does the same thing.

We also honor Global Privacy Control. If your browser sends a GPC signal, Google Analytics and the Meta Pixel are not loaded and your inquiry is not reported to them, without you having to do anything here.

Checking your current setting…

You can also block or delete cookies in your browser settings. Blocking the live chat cookie stops the chat from working, and deleting a wedding_access_ cookie means re-entering that page’s password. If you are signed in to the client dashboard, deleting the Supabase cookie signs you out. Google also offers a browser add-on that blocks Analytics on every site.

Third parties

Google Analytics and the Meta Pixel are the only third-party scripts on the marketing site that set cookies. Our live chat is built in-house on Supabase; its only cookie is live_chat_session, set by our own server. How chat messages are handled (including the AI assistant, which runs on Perplexity’s Sonar model through Vercel AI Gateway) is described in the privacy policy.

Questions