Cookie Policy

Cookies are small text files that a website stores on your device — your computer, tablet, or phone — when you visit it. They are widely used to make websites work correctly, to remember your preferences, and to provide basic usage information to the site operator.

Cookies are not programs and cannot execute code. They cannot carry viruses or install software. They are simply small data files that help a service remember information between visits or across a single browsing session.

BRASI's approach to cookies

This policy explains precisely which cookies we use, why each one exists, how long it lasts, and how you can control or remove it. If you have questions not answered here, contact us at privacy@brasi.io.

BRASI uses four categories of cookie. The table below summarises each category, its purpose, and whether it can be disabled.

Essential cookies are strictly necessary for the platform to operate. Without them, core features — including page loading, security, and consent management — would not function. These cookies cannot be disabled while you use BRASI.

BRASI uses privacy-first analytics to understand how the platform is used in aggregate. This helps us identify pages that are hard to navigate, features that are not being discovered, and technical issues that need fixing.

What our analytics does

• Counts page views per URL to understand which sections are most visited
• Records which country a visit originated from (country-level only, not city or postcode)
• Identifies the browser type and device category (desktop / mobile / tablet)
• Tracks aggregate session duration to understand engagement with content

What our analytics never does

Analytics cookies are optional. You can disable them at any time using the cookie preference centre below, or via your browser settings, without affecting your ability to use any part of BRASI.

When you create an account and sign in to BRASI, authentication cookies are set to securely maintain your signed-in state. These cookies allow the platform to recognise that you are the same person between pages, so you do not need to sign in on every click.

Security properties

• Authentication cookies are set with the HttpOnly flag, meaning they cannot be accessed by JavaScript — this protects against XSS (cross-site scripting) attacks
• Authentication cookies are set with the Secure flag, meaning they are only transmitted over HTTPS connections — never over unencrypted HTTP
• Authentication cookies are scoped to the BRASI domain only and cannot be read by third-party sites
• Token values are cryptographically signed and validated on every request — a modified token is rejected immediately

Preference cookies store lightweight UI state so that the platform remembers your settings between visits. These are optional and contain no personal data. Disabling them means the platform will revert to its defaults each time you visit.

Using the BRASI preference centre

The easiest way to manage your cookie choices on BRASI is to use the preference centre on this page. You can toggle analytics and preference cookies on or off at any time. Essential and authentication cookies cannot be disabled, as they are required for the platform to work.

Managing cookies in your browser

All major browsers allow you to view, block, or delete cookies. The links below point to the official cookie management guides for the most common browsers.

• Google Chrome: Settings → Privacy and security → Cookies and other site data
• Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
• Apple Safari: Preferences → Privacy → Manage Website Data
• Microsoft Edge: Settings → Cookies and site permissions → Cookies and site data

Deleting existing cookies

Clearing your browser's cookies removes all BRASI cookies from your device. This will sign you out of your account and reset your preference choices. Your account and all your private content remain intact server-side — clearing cookies only affects your local session state.

Analytics provider

BRASI uses Plausible Analytics, an open-source, privacy-first analytics platform that does not use cookies to track users and does not collect personally identifiable information. Plausible is GDPR compliant, does not track users across sessions or across sites, and does not build user profiles.

Even within Plausible, BRASI configures exclusion rules to ensure that sensitive platform areas — including any pages related to journaling, provider conversations, or account details — do not appear in analytics reporting.

Content delivery and infrastructure

BRASI's infrastructure uses standard hosting and content-delivery services to ensure the platform loads quickly and securely. These services may set technical cookies as part of network-level security (for example, to distinguish human traffic from automated bots). These technical cookies do not contain personal data and are not used for tracking purposes.

What we will never integrate

• Meta Pixel, Google Ads, or any advertising network cookie
• LinkedIn Insight Tag or any social media tracking pixel
• HotJar, FullStory, or any session-recording tool
• Any third-party service that profiles individual users or shares data with brokers
• Any analytics tool that stores persistent identifiers for individual users

If we ever add a new third-party integration that uses cookies, we will update this policy, notify users, and ask for your consent before activating it. Questions about third-party services can be directed to privacy@brasi.io.