COREN COOKIE NOTICE
Last updated: October 13, 2026
Document version: v1.2.1
Applies to: Coren, the family financial-literacy product operated by The Hiwat Group Sociedad Limitada ("THG SL").
1. About this Notice
This Notice explains how Coren uses cookies and similar browser-storage technologies (such as localStorage and sessionStorage) when a parent or child uses the Coren web application, and which of those technologies need the parent's consent.
This Notice complements the THG SL Privacy Notice and the Coren Privacy Addendum, the underlying documents that describe what personal data Coren processes and why.
This Notice is published in line with Spain's Law on Information Society Services and Electronic Commerce (Law 34/2002, LSSI-CE), the GDPR, and Spanish Organic Law 3/2018 (LOPDGDD), which together govern the use of cookies and similar technologies for users in Spain and the European Union.
2. What is a cookie?
A cookie is a small text file that a website places on the visitor's device to remember information across pages and visits. Similar technologies, such as localStorage, sessionStorage and in-memory identifiers, serve the same purpose without always writing a cookie file. This Notice uses "cookies" for all of them unless a distinction matters.
3. Categories of cookies used by Coren
3.1 Strictly necessary cookies and storage
These are required for Coren to function. Without them, the parent cannot log in, the child cannot use their PIN, and the product cannot remember which household is active. Strictly necessary cookies do not require consent under the LSSI-CE.
| Name | Set by | Purpose | Lifetime | Class |
|---|---|---|---|---|
sb-<project>-auth-token (in several parts) | Supabase SSR auth (our authentication provider) | Parent login session | Default of the authentication library | Strictly necessary |
kid_session | Kid login | Child session | 8 hours | Strictly necessary |
pn_kid_child_id | Kid login | Active child profile | 8 hours | Strictly necessary |
pn_household_auth | Household step of the kid login | Household verification | 10 minutes | Strictly necessary |
pn_terms_accept | Signup | Carries the accepted Terms version to account creation | 15 minutes | Strictly necessary |
pn_language (cookie and localStorage) | Language menu | UI language | 1 year | Strictly necessary |
pn_last_seen (httpOnly) | Parent session | Last-seen throttle | 24 hours | Strictly necessary |
coren_cookie_consent (localStorage) | Cookie banner | Your cookie choice (accepted or declined), so the banner is not shown again on that browser | Until cleared | Strictly necessary |
3.2 Functional preferences
These cookies and storage entries remember in-product choices that improve the experience but are not strictly necessary. They do not personally identify the user beyond what is already stored for the session.
| Name | Set by | Purpose | Lifetime | Class |
|---|---|---|---|---|
pn_jobs_seen_<child> (localStorage) | Pet jobs page | Which jobs a child has seen | Until cleared | Functional |
coren_welcome_back_dismissed_at (localStorage) | Kid welcome banner | Dismissal | Until cleared | Functional |
pn_consent_text_notice_dismissed_<version> (localStorage) | Consent-text notice | Dismissal | Until cleared | Functional |
pn_approvals_banner_dismissed (sessionStorage) | Approvals banner | Dismissal | This tab | Functional |
PN_UPGRADE_INTENT (sessionStorage) | Upgrade link | Remembers which feature led to the plans page | This tab | Functional |
These two tables are the complete list. Coren stores nothing else in the browser, and the analytics service sets no cookie of its own (§3.3).
3.3 Analytics (consent required)
Coren uses PostHog (PostHog Inc., EU Cloud, servers in the European Union) for product analytics. PostHog is loaded only after the parent chooses "Accept" in the cookie banner; before that choice, or after "Decline", no analytics script runs and nothing is sent.
What PostHog receives when analytics is on:
- A fixed set of product events chosen by Coren, all from the parent's part of Coren and the public pages (for example: account created, child added, first chore created, paywall shown), each with a small set of non-identifying properties (plan tier, which share card or referral channel was used, streak length)
- A pseudonymous identifier: an anonymous id before login, and the account's internal user id after login, so that one account's events can be counted once; never the name, email address or any child's name
- Standard request data (browser type, rough region from the IP address, which PostHog stores in the EU)
What it does not do: no automatic click or page-view capture, no session recording, no heatmaps, no surveys, no cross-site tracking, no advertising use, and no cookie of its own (PostHog runs with in-memory persistence, so its identifier disappears when the tab is closed).
Coren does not use third-party advertising trackers, fingerprinting, or behavioural-profiling technologies.
3.4 Marketing
Coren does not use marketing cookies. Marketing communications, where the parent has opted in, are sent by email and are governed by §3.4 of the Coren Privacy Addendum.
4. Third-party processors that may set cookies on Coren's behalf
Where Coren relies on third-party infrastructure, those providers may set their own technical cookies necessary for the service. These currently include:
- The hosting and authentication provider (currently Supabase / its underlying cloud provider)
- The application-hosting provider (currently Vercel)
- The payment provider used for subscription billing (Stripe, on the checkout and customer-portal pages it hosts)
- The analytics provider (PostHog), only after consent and without a cookie of its own (§3.3)
All such providers are contractually bound to handle data only on documented instructions from THG SL and to apply at least the same standard of protection as THG SL itself.
5. Cookies and child users
Coren is designed so that child accounts use the minimum technical cookies and storage necessary to operate the in-app experience. No marketing or behavioural-tracking cookies are placed on child sessions. The cookie banner and analytics appear only in the parent's part of Coren and on the public pages. Child sessions never run analytics.
The parent who set up the child's profile is treated as the consenting party for any cookie use in the child's session, consistent with Coren's universal parental-control model (see §4.1 of the Coren Privacy Addendum). The cookie banner and the analytics choice described in §3.3 belong to the parent; the choice is stored per browser and applies only to the parent's part of Coren and the public pages, never to a child's session.
6. Managing cookies and withdrawing analytics consent
The parent can manage cookies via their browser settings; most browsers allow blocking, deleting, or restricting cookies on a site-by-site basis. Blocking strictly necessary cookies will prevent Coren from working.
You can change your choice at any time via Cookie settings at the bottom of every page. Choosing Decline stops analytics on that browser straight away. Withdrawal stops future collection. Events already received are deleted when the account is deleted.
For Coren-specific questions about cookies or browser-side storage, contact assistant@thehiwatgroup.com.
7. Updates to this Notice
This Notice may be updated from time to time. Material changes will be reflected in the version number and last-updated date at the top of this document.
8. Governing Law
This Notice is governed by Spanish law and read together with the THG SL Privacy Notice and Legal Notice, in line with §7 of the THG SL Legal Notice.
9. Language versions
This Notice is provided in English, Spanish and Dutch. In the event of any discrepancy, the Spanish version shall prevail, consistent with §7 of the THG SL Legal Notice.