Cookie Policy

1. Introduction

This Cookie Policy explains how VisibilityKit, operated by SevenHills Software ("we," "our," or "us"), uses cookies and similar technologies when you visit our website or use the VisibilityKit platform, an AI Engine Optimization (AEO) service that tracks brand citations across 9 AI assistants.

We use cookies to keep you signed in, remember your preferences, and understand how the product is used so we can improve it. For more information about how we handle your personal data generally, please review our Privacy Policy.

2. What Are Cookies

Cookies are small text files that a website stores on your browser when you visit it. They let the site recognize your browser on subsequent visits and remember information about you, such as whether you're signed in or what theme you've selected. Similar technologies (like local storage) work the same way for the purposes of this policy.

3. How We Use Cookies

We use cookies for a small number of clearly defined purposes:

• Authentication: Keep you signed in to your VisibilityKit account between visits
• Security: Protect form submissions from cross-site request forgery (CSRF)
• Preferences: Remember your theme, language, and sidebar layout choices
• Product analytics: Understand which features are used and where users encounter friction, so we can improve the product

4. Types of Cookies We Use

4.1 Strictly Necessary Cookies

These cookies are required for the VisibilityKit platform to work. They cannot be turned off without breaking core functionality such as signing in or submitting forms.

• sb-* (Supabase Auth): Stores your authentication session and refresh token so you stay signed in between page loads
• csrf-token: Protects forms and server actions from cross-site request forgery attacks
• theme: Remembers whether you prefer light or dark mode so the interface doesn't flash on page load
• vk_consent: Remembers your cookie choice (Accept all, Essentials only or Decline) for one year

4.2 Analytics Cookies

Set only if you choose "Accept all". They help us understand how visitors find and use VisibilityKit, so we can prioritize improvements and catch broken flows.

• _bi_v, _bi_s (Visibility Tracker): Our own first-party analytics. A random visitor id (one year) and session id (30 minutes of inactivity) used to count visits, traffic sources and the pages viewed in a visit
• vk-attribution (local storage): The campaign (UTM) parameters, referring site and landing page of your first visit, so we know which channel brought you if you sign up
• _ga, _ga_* (Google Analytics): Distinguish visitors and sessions for aggregate traffic reports, up to two years
• _clck, _clsk (Microsoft Clarity): Session recordings and heatmaps of how pages are used, up to one year
• ph_*: PostHog identifiers used to record page views, feature events, and anonymized device information such as browser and operating system

For more details on how PostHog handles data, see the PostHog Privacy Notice.

4.3 Preference Cookies

These cookies remember small choices that improve your experience but are not required for the platform to function.

• Language / locale: Stores your selected language so we can display the interface in your preferred language
• Sidebar state: Remembers whether you have the navigation sidebar collapsed or expanded

4.4 Advertising / Marketing Cookies

We do not use advertising or remarketing cookies. VisibilityKit does not run ad networks, retargeting pixels, or third-party marketing trackers. We don't share data with advertising platforms.

4.5 Visibility Tracker Cookies (on Customers' Websites)

Websites that use our Visibility Tracker analytics set two first-party cookies on their own domain. They are set by that website, not by visibilitykit.app, contain only random IDs, and are not shared across websites:

• _bi_v: visitor ID, so returning visits can be counted. Expires after up to one year.
• _bi_s: session ID. Expires after 30 minutes of inactivity.

Website owners can run the script in a consent mode that sets no cookie until the visitor agrees. See section 2.6 of our Privacy Policy.

5. Third-Party Cookies

A small number of third-party services set cookies through VisibilityKit. We only use providers we need to deliver the service.

• Google Analytics and Microsoft Clarity (analytics): Loaded only after you choose "Accept all". See the Google Privacy Policy and the Microsoft Privacy Statement.
• PostHog (analytics): Only after you choose "Accept all". Sets analytics cookies across the app to help us understand product usage. See the PostHog Privacy Notice.
• Lemon Squeezy (checkout only): Loaded only on checkout pages to process payments. Lemon Squeezy sets its own session cookies during the payment flow. See the Lemon Squeezy Privacy Policy.

6. Cookie Duration

Cookies fall into two categories based on how long they last:

• Session cookies: Deleted automatically when you close your browser. We use these for short-lived state like CSRF tokens.
• Persistent cookies: Stored with an expiry date and remain on your device until they expire or you delete them. We use these for things like your theme and your signed-in session.

Authentication is handled with two cookies: a short-lived access token and a longer-lived refresh token. The refresh token has a longer expiry so you don't have to sign in every day, while the access token rotates frequently for security.

7. Managing Your Cookies

7.1 Browser Controls

Every modern browser lets you view, delete, and block cookies through its settings. You can find general guidance from MDN's documentation on cookies or in your browser's help pages.

Important: If you block strictly necessary cookies, you will be signed out of VisibilityKit and core parts of the app, including authentication and form submissions, will stop working.

7.2 Your Cookie Choice

On your first visit we ask how you want us to use cookies, and we store your answer in the vk_consent cookie for one year:

• Accept all: strictly necessary cookies plus analytics (Google Analytics, PostHog, Microsoft Clarity and our own Visibility Tracker).
• Essentials only: strictly necessary cookies only. Our Visibility Tracker still counts visits, but without cookies or local storage, using a daily-rotating anonymous hash. This is also how the site behaves before you choose.
• Decline: strictly necessary cookies only and no analytics of any kind.

You can change your choice at any time from Cookie settings, also linked in the footer. Moving away from "Accept all" deletes the analytics cookies we set. Clearing your cookies resets your choice, and we will ask again.

7.3 Do Not Track Signals

Some browsers send a "Do Not Track" (DNT) signal with every request. Because there is no industry consensus on how DNT should be interpreted, VisibilityKit currently does not change its behavior based on DNT. We document this here so you can make an informed choice and choose "Decline" in Cookie settings if you prefer not to be tracked.

8. Updates to This Policy

We may update this Cookie Policy from time to time as we change the product or the tools we rely on. When we make material changes, we'll update the "Last updated" date at the top of this page. We encourage you to review this policy periodically.

9. Contact Us

If you have questions about this Cookie Policy or how we use cookies, please contact us:

• Email: privacy@visibilitykit.app
• Contact Form: /contact

For more information about how we handle your personal data, see our Privacy Policy and Terms of Service.