Cookie & Third-Party Tools Policy
Last updated: 15 July 2026 · Version gary-cookie-v1-draft-2026-07
This Policy explains what cookies and similar technologies Gary uses, and also serves as the always-current, named register of the third-party tools and service providers behind Gary. It is part of our Privacy Policy; terms used here have the meaning given there.
1. What cookies and similar technologies are
Cookies are small text files placed on your device by a website. “Similar technologies” include browser local storage and comparable mechanisms that store or read information on your device. We use the umbrella term “storage” below.
2. What Gary uses
Gary is deliberately light on tracking. We group storage into two kinds.
A. Strictly necessary / functional (no consent required)
These make the app work and deliver the features you ask for. They are not used for advertising or cross-site tracking.
| What | Purpose |
|---|---|
| Authentication / session (Firebase) | Keeps you signed in and secures your account |
| On-device app storage (browser local storage) | Stores, only on your device, your ongoing chat with Gary, your daily mood check-in, your “key moments”, and a local copy of your latest quiz answers - so the app works and remembers your session. Your mood, key moments and quiz copy never leave your device; each chat message you send is processed transiently by us and our AI provider to generate a reply, and not retained. |
| Consent and preferences | Remembers the choices you made (for example your analytics consent) so we can honour them |
B. Analytics (optional - only with your consent)
If you turn on the “usage analytics” consent, we use PostHog to understand how the app is used (screens, taps, progress through flows) so we can improve it.
- Nothing is stored on your device or sent to PostHog for analytics until you opt in.
- Traffic goes through our own first-party reverse proxy; IP capture is off.
- Your wellbeing answers are never included in analytics.
- You can withdraw this at any time in Account → Privacy & consent.
We do not use advertising, marketing, or cross-site tracking cookies.
3. Register of third-party service providers
This is the current, named list of the third-party providers used by Gary. Our Privacy Policy describes recipients of your data by category and refers to this register for the specific names.
| Provider | What it does | Where | Consent-gated? |
|---|---|---|---|
| Google Cloud / Firebase | Sign-in, database and hosting of your Health Profile and consent records | Database + consent records: UK (London). Sign-in: US. Hosting: EU (Netherlands). | No (necessary to run the service) |
| PostHog | Product analytics | EU (Frankfurt), via our first-party reverse proxy; IP off | Yes (only if you opt in) |
| Google Vertex AI | AI-generated responses and audio, on a pseudonymised profile summary | EU region, or Google’s global multi-region infrastructure | Yes (only with “Let Gary use AI”) |
4. Changes to this register
We keep this register up to date. If we add, remove, or change a provider in a way that affects your data, we update this document (and, where a new consent is needed, we ask you first). The “Last updated” date shows the current version.
5. Your choices
- In-app: manage your analytics and AI consents any time in Account → Privacy & consent.
- In your browser: you can clear or block storage via your browser settings. Clearing storage will sign you out and remove the on-device data listed in section 2A (your chat, mood, and key moments). Blocking strictly-necessary storage may stop parts of Gary working.
6. Contact
Pleso Therapy sp. z o.o., ul. 12 Lutego 25/7, 82-300 Elbląg, Poland · Data Protection Officer: iod@pleso.me · General enquiries: hello@pleso.me