1. The short version
What we set without asking is the handful of cookies and browser values the service cannot run without — signing you in, finishing a two-factor step, keeping your place in the wizard, remembering this choice. Everything that measures — Google Analytics, the Meta Pixel, and our referral-link click count — is off until you switch it on, and switching it back off clears what it stored. We do not sell your personal data, and we do not use any of this to make automated decisions about you.
2. What a cookie is here
"Cookie" in this policy is shorthand for any technology that stores something on your device or reads something back off it — classic cookies, but also tracking pixels, localStorage and similar browser storage. European law treats them the same way and so do we: if it touches your device and it is not strictly necessary, it waits for your permission.
3. Strictly necessary
These are exempt from consent because the service you asked for cannot be delivered without them. There is no switch for them; blocking them in your browser will sign you out and make the banner reappear on every page.
| Cookie | Set by | What it does | Lasts |
|---|---|---|---|
| access_token | AutoVidGen | Keeps you signed in. Set only after you sign in, and read on every request to your account. | Session / short-lived |
| refresh_token | AutoVidGen | Renews your session so you are not signed out mid-render. | Up to 30 days |
| twofa_pending | AutoVidGen | Authorises the second step of a two-factor sign-in, and nothing else. Set only if you have 2FA on. | 5 minutes |
| google_consent_pending | AutoVidGen | Holds a Google sign-in half-finished while you accept the Terms. Set only during that step. | 10 minutes |
| avg_consent | AutoVidGen | Remembers this exact choice, plus when you made it and which version of this policy it was made against. Without it we would have to ask on every page. | 180 days |
3a. Browser storage, not cookies
The same rules cover things kept in your browser's own storage rather than in a cookie, so here they are. Everything in this list except the last row is strictly necessary; the last row waits for analytics consent like anything else that measures.
| Cookie | Set by | What it does | Lasts |
|---|---|---|---|
| affiliateRef | AutoVidGen | The partner code from a referral link you followed, so the referral is still credited when you sign up. Holds no identifier for you, and is deleted the moment you register. | Until you sign up |
| rememberMe | AutoVidGen | Remembers whether you ticked "remember me", so the sign-in form comes back the way you left it. | Until you clear it |
| oauth_state, pkce_code_verifier, googleOAuthState, googleTermsAccepted, affiliateRefForGoogle, connectReturnTo | AutoVidGen | One-time values that make a sign-in or a channel connection safe to complete — they are what stops someone else finishing the flow in your name. | One tab session |
| seriesDraft, pendingSeries | AutoVidGen | Your work in progress in the series wizard, so a refresh mid-way does not throw it away. | One tab session |
| affiliateVisitorKey, affiliateClickSent:* | AutoVidGen | Counts a referral-link click once instead of once per page. Written only if you allowed analytics, and scoped to the tab — it is not an identifier that follows you. | One tab session |
Embedded videos. The demo clips on our home page are still images until you click one. Only then does a YouTube player load, from the youtube-nocookie.com domain, and only then can YouTube store anything on your device — under Google's policy rather than ours. If you never press play, YouTube is never contacted.
4. Analytics — optional, off by default
Google Analytics 4. Tells us which pages are read, how people find us and where they give up. We use it in aggregate — to decide what to build and what to rewrite — not to profile individuals. Nothing below is requested, and no request is made to Google at all, until you turn this on.
| Cookie | Set by | What it does | Lasts |
|---|---|---|---|
| _ga | Distinguishes one visitor from another so a returning reader is not counted as a new one. | 2 years | |
| _ga_<stream id> | Holds the Google Analytics 4 session state — where you arrived from, and whether this is a new session. | 2 years |
This switch also covers our own referral-link click count — the last row in section 3a. It never leaves our servers and goes to no third party, but it is measurement rather than something you asked for, so it waits for the same yes.
5. Marketing — optional, off by default
Meta Pixel. Tells us which ads brought people here, and lets Meta build advertising audiences from that. This is the category that involves a third party using data about you for its own advertising purposes, which is exactly why it is a separate switch.
| Cookie | Set by | What it does | Lasts |
|---|---|---|---|
| _fbp | Meta | Identifies the browser to Meta so we can tell which ads led to a signup, and so Meta can build advertising audiences. | 3 months |
| _fbc | Meta | Stores the click identifier from a Meta ad. Set only if you reached us by clicking one. | 3 months |
6. Where the data goes
Google and Meta are both established outside the EEA and process this data in the United States, among other places. Where we rely on your consent for that transfer we ask for it here; the providers additionally rely on the EU–US Data Privacy Framework and on Standard Contractual Clauses. Each acts as a controller for what it collects through its own tag, under its own policy — Google and Meta.
7. Your choice, and taking it back
Refusing is one click, in the same place and at the same size as accepting, and refusing costs you nothing — every part of the service works either way. Your answer is stored for 180 days; after that we ask again. If we change what we load, or materially change this policy, we ask again immediately rather than assuming the old answer still covers it.
Withdrawing is the same one click, from the Cookie settings link in the footer of every page. When you withdraw, we delete the cookies and stored values that category wrote — only that category's, so turning marketing off leaves analytics alone — and, if the tag is running on the page you are looking at, reload it, because a script already loaded cannot be unloaded any other way. Other tabs you have open are told at the same time. Data already sent to Google or Meta has to be requested from them; we will help if you email us.
You can also block or delete cookies in your browser, use Google's Analytics opt-out add-on, and adjust Meta's ad preferences and off-Facebook activity settings in your Meta account.
8. Questions and complaints
Email admin@autovidgen.com. If you are in the EEA or the UK you also have the right to complain to your national data protection authority. The wider picture — what else we collect, how long we keep it, and your access and deletion rights — is in the Privacy Policy.