The cookies and similar technologies GRAIL uses, why, and how to change your preferences.
Cookies are small files a website stores in your browser. Similar technologies, such as your browser's local storage, let a site remember information between pages and visits.
This page explains which of these GRAIL uses, why, and how you can control the optional ones. It describes how GRAIL works and sits alongside the GRAIL Privacy Policy (linked below), which explains how GRAIL handles personal information.
These keep GRAIL secure and working. They are always on, because the site cannot function without them.
Sign-in and session: when you sign in, GRAIL's authentication provider, Supabase, keeps your session in your browser so you stay signed in, and GRAIL sets a secure, HTTP-only session cookie (__grail_auth_token) that protects signed-in pages. The session cookie lasts up to one hour and is renewed while you use the site; it is removed when you sign out.
Security and fraud prevention: the sign-in and account-creation pages use Cloudflare Turnstile to tell people apart from automated abuse. Turnstile runs from Cloudflare and may set or read its own cookies for that purpose.
Checkout: payment happens on Stripe's hosted checkout page. Stripe may use its own cookies there for payment security and fraud prevention; GRAIL never sees your full card details.
Your cookie choice: GRAIL stores your cookie preferences in a first-party cookie (grail_cookie_consent) for about six months, so it does not ask you again on every visit. It records only your choices and when you made them.
Features you use: GRAIL also uses your browser's local storage for things you start yourself, such as remembering a referral or ambassador link you followed until you finish signing up, onboarding progress, and display preferences like grid or compact view. This information stays in your browser.
GRAIL uses one analytics technology, Vercel Web Analytics, and only if you allow Analytics in your cookie preferences. It is optional and off by default; nothing is loaded or sent until you turn it on.
Provider: Vercel, which hosts GRAIL. Purpose: understanding how GRAIL is used and how it performs, such as which public marketplace pages are visited. It measures page visits on GRAIL's public pages only: signed-in areas such as your account, messages, orders, checkout, wallet and admin are not measured, and GRAIL removes search terms and other query details from page addresses before anything is sent.
Vercel Web Analytics does not set cookies in your browser; it is an analytics technology rather than an analytics cookie. GRAIL does not send it your name, email address, payment details, messages or other account information. Vercel processes the data it receives under its own privacy terms.
If you turn Analytics off later, GRAIL stops sending analytics from that point on.
GRAIL does not currently use any marketing or advertising cookies, pixels, or similar technologies.
If that changes, marketing technologies will run only if you allow them in your cookie preferences, and this page will be updated first. Marketing is off unless you turn it on.
If your browser sends a Global Privacy Control signal, GRAIL treats it as a request to keep marketing off, and the marketing setting cannot be turned on from that browser.
The first time you visit, GRAIL asks whether to allow optional technologies. You can reject them as easily as you can accept them.
You can change your choice at any time from "Cookie settings" in the footer of every page. You can also clear or block cookies in your browser's settings; blocking essential cookies will stop sign-in and other core features from working.
The session cookie lasts up to one hour and is renewed while you are signed in. Your cookie choice is kept for about six months, after which GRAIL asks again. GRAIL also asks again when the kinds of technology it uses change, as it did when Vercel Web Analytics was added.
Information in your browser's local storage stays until the feature that saved it no longer needs it, or until you clear it. Cookies set by Cloudflare or Stripe follow their own retention.
All GRAIL legal pages remain available from one consistent Trust Center library.