Cookie policy
Most of what OutPull sets is strictly necessary — signing you in, counting your vote once, keeping the site secure. One thing is not, and you are asked before it loads.
- Whether a data protection impact assessment is needed for the advertising pixel has not been assessed.
What you are asked, and what you are not
Under the ePrivacy Directive as implemented in Italy, and the Italian data protection authority's 2021 cookie guidelines, consent is required for anything that is not strictly necessary to deliver a service you asked for.
The cookies that sign you in, record that you have already pulled, and protect form submissions are strictly necessary in that sense. They are always on and there is nothing to consent to.
The Meta advertising pixel is not necessary, so it is not loaded until you accept it. Refusing is a single click, exactly like accepting, and the refusal is remembered so you are not asked again. Nothing is fetched from Meta and no Meta cookie exists on your device until you have said yes.
Strictly necessary cookies
These cannot be switched off without breaking the service.
- Authentication cookies set by Supabase, which keep a signed-in founder session alive and carry the verifier that completes a sign-in link. Session-based, cleared on sign-out.
- A per-battle marker recording that this device has already pulled in the current battle, so the same person cannot vote twice. It expires when the battle does.
- A voter secret stored HttpOnly on your device, hashed into a voter key. It identifies a repeat vote and nothing else, and is never sent to any third party.
- Security cookies protecting form submissions against cross-site request forgery.
Marketing — only if you accept
The Meta pixel (Meta Platforms Ireland Limited) measures how people arrive at OutPull and whether a visit led to registering a product or casting a pull, so that advertising spend can be judged against something real.
It sets cookies under the facebook.com and connect.facebook.net domains, typically lasting up to 90 days, and it reports to Meta that a page was viewed along with the standard technical data any web request carries. Meta may combine this with an account you hold with them.
The pixel id is 1629908438479578. It loads only on outpull.tech, so any preview or development copy of the site never reports anything.
You can change your mind at any time by clearing this site's storage in your browser, which brings the question back.
What we still do not set
No analytics or measurement cookies of our own. No data broker sharing, and nothing is sold. Apart from the Meta pixel described above, which you control, nothing on OutPull follows you to another website.
Third parties that set their own
Cloudflare Turnstile sets a cookie while it verifies that a visitor is a person rather than a script. It is part of the anti-abuse check and is governed by Cloudflare's own policy.
PayPal sets its own cookies during checkout on its pages, governed by PayPal's cookie policy. We do not control them and do not receive their contents.
Vercel, which hosts the site, may set a cookie for load balancing.
Managing cookies
You can clear or block cookies in your browser settings. Blocking the ones above means you will not be able to sign in as a founder, and your pull may not register.
Questions about this policy can be sent to info@outpull.tech.