Cookie Policy

1. Scope of This Cookie Policy

Grace Unworthy Ministries, LLC ("we," "our," or "us") uses cookies and similar technologies across our web properties, mobile applications, and services. This document applies to the properties listed in our Covered Properties notice, which is incorporated by reference.

This Cookie Policy explains what these technologies are, how and why we use them, what choices you have, and which measurement still runs outside the banner (for example mobile SDKs and certain server-side advertising events). It should be read together with our Privacy Policy and our Notice at Collection & Do Not Sell or Share.

2. What Cookies and Similar Technologies Are

Cookies are small text files placed on your device (computer, smartphone, or tablet) when you visit a website. They are widely used to make websites function, to remember your preferences, and to report information back to site operators.

Cookies may be "session" cookies, which are deleted when you close your browser, or "persistent" cookies, which remain on your device until they expire or you delete them. Cookies set by the site you are visiting are called first-party cookies; cookies set by another company whose code runs on our pages are called third-party cookies.

We also use technologies that are not technically cookies but serve similar purposes, and this Policy covers them as well:

• Browser storage: localStorage and sessionStorage, which store values (including your cookie banner choice) in your browser.
• Pixels and tags: small pieces of code or invisible images that report page views, clicks, and conversions to advertising and analytics platforms.
• Software development kits (SDKs): analytics and attribution libraries embedded in our mobile applications.
• Device and browser fingerprinting: techniques that derive a probabilistic identifier from device and browser characteristics without storing a cookie.
• Server-side measurement: events sent from our servers to advertising and analytics platforms rather than from your browser.

3. Types of Cookies We Use

4. Your Consent Choices and How They Work

On web properties in the EEA, United Kingdom, and Switzerland — or when we cannot determine your country — we display a cookie banner before optional analytics, marketing, and diagnostics tools load. You can Accept those tools, Decline them, or open Preferences to allow each category separately. Outside those regions, optional tools may load by default; a persistent Cookie preferences control remains available on every page so you can Decline or change Preferences after tracking has started. Declining or turning a category off unmounts the matching tags and clears first-party vendor cookies we can reach from the browser (historical data already sent to vendors is not erased).

Your selection is stored in your browser using localStorage (the purpose-level record for analytics, marketing, and diagnostics), and a short first-party preference cookie mirrors that a choice exists so we do not flash the banner again on later visits. The record includes the Cookie Policy version and banner UI version at the time of consent. It is not stored in a server-side profile tied to your identity.

Because the choice is stored in your browser, it applies only to that browser on that device. If you clear your browser storage, use private or incognito browsing, switch browsers, or use another device, you may be asked again (where a banner is required) or default tracking may resume outside consent-required regions until you set Preferences again. You can also reopen Preferences with ?showPrefs=1 on the URL.

When you Decline or turn a category off in Preferences, we do not load the matching banner-controlled tags described in Section 6 in that browser. Remaining gaps — including mobile SDKs and certain server-side advertising events — are described in Section 5.

You can change your choice with the Cookie preferences control, by clearing cookies and site data for our domain in your browser, or by using browser-level controls described in Section 7.

5. Tracking That Operates Outside or Alongside the Banner

We believe a cookie policy is only useful if it is honest about the gaps. The following measurement still operates outside our cookie banner, or is not fully controlled by Accept / Decline / Preferences on banner-enabled web properties.

5.1 Cloudflare Web Analytics

We use Cloudflare Web Analytics to measure site performance and traffic — for example page load timing, Core Web Vitals, and aggregate visit counts. On banner-enabled web properties, Cloudflare Web Analytics is gated behind analytics consent (Accept, or Preferences with Analytics enabled). Decline, or Preferences with Analytics off, prevents it from loading in that browser. Cloudflare Web Analytics is designed to be privacy-oriented and does not use cookies for cross-site tracking or build advertising profiles. See the Cloudflare Privacy Policy.

5.2 The Story Haven on the web

On The Story Haven web experience (thestoryhaven.net), the same geo-based consent rules apply as on our other web properties. Where a banner is required, Accept, Decline, and Preferences (Analytics, Marketing, and Diagnostics) apply to banner-controlled tags the same way. Outside consent-required regions, optional tags may start by default and can be turned off with Cookie preferences. Community product analytics used to operate and improve The Story Haven may still include essential platform measurement described elsewhere in this policy and our Privacy Policy; optional third-party tags remain gated by your banner or preferences choice.

5.3 The Story Haven mobile application

Mobile applications do not use browser cookies, and our cookie banner does not exist inside the app. The Story Haven mobile app includes the following analytics and measurement components:

• Vexo Analytics — in-app product analytics (screens viewed, feature usage, and similar interaction events).
• Firebase Analytics — app usage, retention, and crash-adjacent diagnostics provided by Google.
• Meta App Events — app install and in-app event reporting used for advertising measurement and attribution.
• TikTok events — app install and in-app event reporting used for advertising measurement and attribution.

On iOS, Apple's App Tracking Transparency (ATT) framework requires apps to request permission before accessing the device identifier for advertisers (IDFA) or otherwise tracking you across apps and websites owned by other companies. We present the ATT prompt on iOS, and if you decline, we do not access the IDFA for cross-app tracking.

Use of the mobile app is also governed by our End User License Agreement (EULA) and the terms of the applicable app store.

5.4 Device fingerprinting (FingerprintJS)

We use FingerprintJS to derive a device identifier from browser and device characteristics. We use this identifier for first-party advertising frequency capping — so that promotions and offers we display on our own properties are not shown to the same visitor repeatedly — and for related abuse prevention on those placements.

On banner-enabled web properties, FingerprintJS is gated behind marketing consent (or kept off when GPC is present). Decline, Preferences with Marketing off, or a GPC signal prevents FingerprintJS from loading in that browser. It is used for our own placements on our own properties; we do not use it to build advertising profiles for sale to third parties. See our Notice at Collection & Do Not Sell or Share for information about opting out of the sale or sharing of personal information, and our Privacy Policy for your access and deletion rights. See also the Fingerprint privacy policy.

5.5 LogRocket session replay

We use LogRocket to record sessions and reproduce errors — capturing page interactions, console and network diagnostics, and similar troubleshooting data. On web properties where our banner is displayed, LogRocket is gated behind Diagnostics / session replay consent: Decline, or Preferences with Diagnostics off, prevents it from loading in that browser (Analytics alone does not enable LogRocket). See the LogRocket privacy policy. Our safeguards for this kind of diagnostic data are described in our Security Policy.

6. Third-Party Services and Identifiers

The following third-party services may set cookies, read identifiers, or receive event data about your use of our properties. Each has its own privacy policy governing how it handles that data. Where these tags run on web properties with our banner, analytics tools require analytics consent, marketing tools require marketing consent, and LogRocket requires diagnostics consent (Section 4), subject to GPC for marketing.

• Google Tag Manager — used as an analytics-only tag container on our web properties. We do not load Meta, TikTok, or other advertising pixels through GTM; those load separately under marketing consent. Privacy Policy
• Google Analytics 4 — Measurement ID G-DKL3XCSDDC. Reports traffic, engagement, and conversion events. Privacy Policy
• Meta (Facebook) Pixel — Pixel ID 1814278155664773. Measures ad performance and supports audience building and remarketing. Privacy Policy
• TikTok Pixel — Pixel ID CM0SIN3C77U3524O7D50. Measures ad performance and supports audience building. Privacy Policy
• Meta Conversions API (server-side) — conversion events (such as a completed purchase or sign-up) sent from our servers to Meta rather than from your browser. Because these events originate server-side, browser-level cookie blocking and content blockers do not prevent them; they are governed instead by our data practices and your rights under our Privacy Policy and Notice at Collection & Do Not Sell or Share.
• Google Analytics 4 Measurement Protocol (server-side) — analytics and conversion events sent from our servers to Google Analytics rather than from your browser, with the same server-side considerations noted above.

Third-party platforms that distribute our podcast and video content (such as podcast directories, streaming services, and video platforms) also collect listener and viewer data under their own policies when you use them. That collection is outside our control and is not governed by our cookie banner.

7. How to Manage Cookies and Tracking

7.1 Browser controls

Most browsers accept cookies by default but let you block or delete them. Blocking cookies broadly — including essential cookies — will break sign-in and other core functionality on our sites.

• Google Chrome: Settings > Privacy and security > Third-party cookies / Cookies and other site data
• Mozilla Firefox: Settings > Privacy & Security > Cookies and Site Data
• Safari: Settings > Privacy > Cookies and website data (and Prevent cross-site tracking)
• Microsoft Edge: Settings > Cookies and site permissions

Clearing cookies and site data for our domain also clears the localStorage value holding your banner choice, so the banner will appear again on your next visit. Browser privacy modes and content blockers can additionally block scripts described in Sections 5 and 6, including Cloudflare Web Analytics and fingerprinting.

7.2 Mobile device controls

• iOS: Settings > Privacy & Security > Tracking to review or revoke app tracking permission, and Settings > Privacy & Security > Apple Advertising for Apple-delivered personalization.
• Android: Settings > Privacy / Ads to delete or reset your advertising ID and opt out of ads personalization.
• Uninstalling the app stops further in-app analytics collection from that device.

7.3 Advertising platform opt-outs

• Digital Advertising Alliance: optout.aboutads.info
• Network Advertising Initiative: optout.networkadvertising.org
• Google Ads settings: adssettings.google.com
• Meta ad preferences: facebook.com/ads/preferences

7.4 Do Not Track and Global Privacy Control

Some browsers offer a "Do Not Track" (DNT) setting. There is no common industry standard for interpreting DNT, and we do not currently respond to DNT signals. We do automatically honor Global Privacy Control (GPC) on banner-enabled web properties by keeping marketing / advertising tools off, as described in Section 4. For a complete account-level Do Not Sell or Share request, see our Notice at Collection & Do Not Sell or Share.

8. Legal Bases and Regional Notes

Essential cookies are used because they are strictly necessary to deliver the service you request. Analytics, marketing, and diagnostics technologies are used based on your consent where consent is required by applicable law, and otherwise based on our legitimate interest in measuring and improving our services.

If you are in the European Economic Area or the United Kingdom, note the limitations described in Sections 4 and 5: our banner offers Accept, Decline, and Preferences for Analytics, Marketing, and Diagnostics on our web properties (including The Story Haven web experience), but mobile SDKs are outside the browser banner, server-side advertising events are not yet fully tied to a server-side consent record, and withdrawing consent still requires clearing site data (or a temporary query parameter) rather than a permanent Preferences reopen control. If you wish to object to processing, or to request access to or deletion of data associated with you, contact us using Section 10 and see our GDPR & UK GDPR Privacy Notice (and our Privacy Policy) for the full description of your rights.

If you are a California resident, our Notice at Collection & Do Not Sell or Share explains the categories of personal information we collect, the notice provided at collection, and how to exercise do-not-sell or do-not-share options.

9. Changes to This Cookie Policy

We may update this Cookie Policy to reflect changes in the technologies we use or for operational, legal, or regulatory reasons. When we make material changes, we will update the Last Updated date shown at the top of this page. If we extend the banner to properties where it is not shown today, or change how server-side advertising events relate to consent, we will revise this Policy to describe the change accurately.

We encourage you to review this Policy periodically so you understand what is collected and what choices are available.

10. Contact Us

Questions about cookies, tracking technologies, or the disclosures on this page can be sent to our Data Protection Contact. Privacy rights requests — including access, correction, and deletion — can be sent to [email protected].

For related information, see our Privacy Policy and our Notice at Collection & Do Not Sell or Share.