Cookie Policy

Last updated 9 May 2026Version 1.0

This Cookie Policy explains what cookies, localStorage keys, and similar technologies Vesspr uses, why we use them, and how you can control them. This policy covers the Vesspr web application at vesspr.ai only — the Vesspr service delivered via Telegram and WhatsApp does not use browser cookies.

1. Introduction

Karooli Garage Private Limited ("Karooli.ai", "we", "us") uses a minimal set of cookies and browser storage to operate the Vesspr web application. We do not use advertising cookies, retargeting pixels, or cross-site tracking of any kind.

Vesspr is an emotional-wellbeing software product that delivers scheduled, opt-in conversational check-ins grounded in attachment theory, cognitive-behavioural therapy frameworks, and emotional resilience research. It is not a medical device, not a therapy substitute, not a romantic partner, and not a replacement for human connection.

2. Categories of Technologies We Use

We classify our use of browser storage into four categories:

  • Strictly Necessary: Required for authentication, session management, and security. Cannot be disabled without breaking core functionality.
  • Functional: Store user preferences and onboarding progress to improve your experience. Not required for the service to function at a basic level.
  • Analytics (Optional): Help us understand aggregate usage patterns. No personal identifiers are tracked cross-site. You may opt out.
  • Payment Processor: Set by our Merchant of Record (Dodo Payments, or Creem.io as fallback) during checkout to prevent fraud. Governed by the provider's own privacy policy.

3. Complete Cookie and Storage Table

The following table lists every cookie, localStorage key, and sessionStorage key set by the Vesspr web application. This list is audited against the codebase and reflects actual behaviour as of the date above.

3.1 Server-Set Cookies (httpOnly)

Namekaroli-auth-token
PurposeAuthentication — stores a signed JWT identifying the logged-in user
TypeStrictly Necessary
Duration1 year
PartyFirst party (vesspr.ai)
httpOnlyYes — not accessible to JavaScript
Namekaroli-user-id (legacy)
PurposeLegacy authentication identifier — read-only for backwards compatibility, never newly written
TypeStrictly Necessary
DurationSession
PartyFirst party (vesspr.ai)
httpOnlyYes

3.2 localStorage Keys (Client-Set)

Namekaroli-onboarding
PurposeSaves in-progress onboarding form state so you can resume if you close the browser
TypeFunctional
DurationPersistent until onboarding completes (then deleted)
PartyFirst party
NoteYour password and email are explicitly excluded from this stored payload — they are never written to localStorage
Namekaroli-onboarded
PurposeFlag indicating onboarding has been completed — used to route returning users to the dashboard
TypeFunctional
DurationPersistent
PartyFirst party

3.3 sessionStorage Keys (Client-Set)

Namevesspr.introSeen
PurposePrevents the landing page intro animation from replaying within the same browser session
TypeFunctional
DurationCurrent session only (cleared when tab closes)
PartyFirst party

3.4 Analytics (Optional)

When enabled, the following third-party analytics tools store data in your browser:

ProviderPostHog
StoragelocalStorage (ph_* prefixed keys)
PurposeSession replay, feature flags, anonymous usage analytics
DurationPersistent
PartyThird party (PostHog, Inc.)
NoteConfigured with persistence: "localStorage" — PostHog does NOT set cookies
ProviderMicrosoft Clarity
StorageCookies (_clck, _clsk)
PurposeHeatmaps, scroll depth, dead click detection
Duration_clck: 12 months; _clsk: session
PartyThird party (Microsoft Corporation)
NoteOnly loads when NEXT_PUBLIC_CLARITY_PROJECT_ID environment variable is configured

3.5 Payment Processor

During checkout, our Merchant of Record — Dodo Payments (dodopayments.com) as primary, or Creem.io (creem.io) where applicable — may set its own cookies for fraud prevention and session management. These are governed by the respective provider's privacy policy. We do not control these cookies.

4. Technologies We Do NOT Use

To be explicit, Vesspr does not use any of the following:

  • Google Analytics or Google Tag Manager
  • Facebook Pixel or Meta tracking
  • Mixpanel, Amplitude, or Segment
  • Advertising cookies or retargeting pixels of any kind
  • Cross-site tracking scripts
  • Fingerprinting or canvas-based identification

This is verified by automated codebase audit. If you believe a third-party tracker has been loaded in error, please report it to privacy@karooli.ai.

5. Consent and Control

Strictly Necessary cookies and storage cannot be disabled — they are required for the service to function (authentication, session management). If you block all cookies in your browser settings, you will not be able to log in.

Analytics technologies (PostHog, Microsoft Clarity) are optional. You may:

  • Disable analytics by blocking third-party scripts in your browser or using an ad-blocker;
  • Clear PostHog data by removing all localStorage keys prefixed with ph_ from your browser's developer tools;
  • Clear Clarity cookies by deleting _clck and _clsk from your browser cookie settings;
  • Contact privacy@karooli.ai to request we exclude your account from analytics.

6. Do Not Track

Vesspr respects the Do Not Track (DNT) browser signal. When DNT is enabled, we suppress the loading of optional analytics scripts (PostHog and Microsoft Clarity). Strictly Necessary cookies are still set, as they are required for authentication.

7. Changes to This Policy

If we add new cookies or storage mechanisms, we will update this policy and change the "Last Updated" date. Material changes (such as adding a new third-party analytics provider) will be communicated via email to registered users at least 14 days in advance.

8. Contact

For questions about this Cookie Policy or to exercise your rights regarding analytics data, contact privacy@karooli.ai.

Related policies: Privacy Policy (/privacy), Terms of Service (/terms), Refund Policy (/refund).

Last updated 9 May 2026Questions? privacy@karooli.ai