Effective Date: June 17, 2026 · Version: 1.0
Audience: public (anyone visiting Hubabble or using its services, including coaches, their clients, and general visitors).
1. About this notice
This notice explains how Hubabble, LLC ("Hubabble," "we," "us," or "our") uses cookies, similar technologies, and lightweight telemetry on our websites and in our product. It is meant to be read alongside our Privacy Policy, which explains the broader picture of how we handle personal information.
Hubabble, LLC is a member-managed multi-member limited liability company organized under Oregon law.
Our keep-it-simple promise: today Hubabble runs on a small, essential set of cookies plus one lightweight performance-telemetry tool. We do not use advertising cookies, marketing pixels, or behavioral profiling. We do not sell your information, and we do not let anyone use it to follow you around the web.
2. What cookies and similar technologies are
A cookie is a small text file a website stores on your device so it can remember things between page loads. "Similar technologies" include local storage, session storage, and small pieces of code that load when a page renders and report back basic information (for example, how quickly the page loaded). In this notice, when we say "cookies," we mean cookies and these similar technologies together unless we say otherwise.
We group what we use into two buckets:
- Essential. Needed for the site and product to work at all. Without these you could not sign in, stay signed in, submit a form securely, or have the product remember basic choices. Essential cookies do not require consent under most laws because the service cannot function without them.
- Non-essential. Everything else (analytics that is not strictly necessary, advertising, behavioral tracking). Today we use almost none of this. The one performance tool we run is described in Section 4, and we flag below where it sits on the essential/non-essential line so counsel can decide.
3. What we use today
Today Hubabble uses only:
- Essential and authentication cookies that keep you signed in, protect forms and requests from cross-site attacks, and remember basic, non-tracking preferences.
- Vercel Speed Insights, a lightweight performance-telemetry tool from our hosting provider that measures how fast pages load and render.
That is the whole list. We do not use:
- Advertising or marketing cookies or pixels.
- Behavioral analytics or product-analytics profiling tools (for example, PostHog). A product-analytics tool is on our future roadmap but is not in use today, and we will update this notice before we turn anything like it on.
- Social media tracking widgets.
- Third-party cross-site trackers of any kind.
4. Cookie and tracking table
The table below lists what Hubabble sets or loads today, what it is for, who sets it, roughly how long it lasts, and whether it is essential. Exact cookie names, domains, and lifetimes are implementation details that may change over time.
| Item | Type | Purpose | Set by | Approx. lifetime | Essential? |
|---|---|---|---|---|---|
| Session / authentication cookie | Cookie (HTTP-only) | Keeps you securely signed in across pages and requests. Issued and managed by our authentication system. | Hubabble (first party) | Session, up to 30 days | Yes |
| CSRF / request-integrity token | Cookie or token | Protects forms and actions against cross-site request forgery. | Hubabble (first party) | Session | Yes |
| Local/session storage for app state and non-tracking preferences | Local/session storage | Remembers basic interface state and choices so the product behaves consistently. Not used to track you across sites. | Hubabble (first party) | Until cleared / session | Yes |
| Tokenized-link routing state | Cookie or in-page state | Lets a client open a secure tokenized link (for example, to view, sign, or pay) without creating a Hubabble account. These routes are sent with a no-referrer policy so the secret in the link is not leaked onward. | Hubabble (first party) | Short-lived / per link | Yes |
| Vercel Speed Insights | Performance telemetry | Measures real-world page-load and rendering performance (web-vitals style metrics) so we can keep pages fast. Provided by our hosting and edge provider. | Vercel (subprocessor) | Cookieless, aggregated beacon (sets no cookie or persistent identifier) | Essential (strictly necessary performance measurement) |
5. Why our footprint is this small (and honest)
Hubabble is deliberately built to collect as little as possible. We chose a single performance tool from our existing hosting provider rather than bolting on a separate analytics suite, and we deferred product analytics entirely for now. This keeps the cookie picture simple and keeps us from claiming consent or tracking we do not actually do.
We would rather under-promise here than over-claim. If that changes, Section 7 explains what we will do before turning anything new on.
6. Consent: where things stand today
Most laws treat essential cookies (Section 4, rows marked "Yes") as not requiring opt-in consent, because the service cannot function without them. We rely on that basis for those cookies.
The one item that needs a decision is Vercel Speed Insights. Under the EU ePrivacy Directive and UK PECR, storing or reading information on a user's device generally requires consent unless it is strictly necessary to provide the service the user asked for. Pure performance measurement is sometimes treated as strictly necessary and sometimes not, depending on how it is implemented and which regulator you ask.
We have not built a cookie consent banner, and at our current footprint we do not believe one is required. Vercel Speed Insights is cookieless and aggregated: it sets no cookie or persistent identifier on your device, which supports treating it as strictly necessary performance measurement. If we ever change how it is implemented, or add any non-essential analytics, we will reassess and add a banner or consent step before doing so, as described in Section 7.
7. If we add non-essential tracking later (consent banner trigger)
A cookie consent banner, and the related opt-out and preference machinery, becomes required only if and when we add non-essential analytics or advertising technologies. Concretely, before we turn on anything like a product-analytics tool (for example, PostHog), marketing pixels, retargeting, or any cross-site or behavioral tracking, we will:
- Update this notice and the Privacy Policy, with a new Effective Date and Version, to list exactly what is being added and why.
- Implement a consent mechanism appropriate to the applicable jurisdictions. For the EU/UK this means prior, informed, opt-in consent before non-essential cookies are set, with an equally easy way to decline and to change your mind later. (We would build the consent banner and the controls that withhold non-essential scripts as part of that work; they are not needed today because we run no non-essential tracking.)
- Assess US state-law obligations. Several US state privacy laws (for example California's CCPA/CPRA) treat certain uses of tracking technologies as a "sale" or "sharing" of personal information for cross-context behavioral advertising, which triggers a "Do Not Sell or Share My Personal Information" right and an opt-out signal (including Global Privacy Control) obligation. If we ever add such technology, we would add the required opt-out link, honor Global Privacy Control, and make the related disclosures. None of this is required at our current footprint, because we do not use advertising or cross-context tracking.
To be clear: as of the Effective Date above, none of this applies, because we do not run non-essential analytics or advertising. This section describes the trigger and the commitment, not a current practice.
8. How telemetry relates to your data and our role
This notice covers cookies and on-device technologies specifically. Our broader data practices, including the roles we play, are in the Privacy Policy. In short:
Hubabble is the controller of coach, account, and visitor data, including the limited performance telemetry described here. For a coach's client data, the coach is the controller and Hubabble is the processor. Clients interact with Hubabble surfaces directly through tokenized links on the coach's behalf.
Our payment provider, Stripe, plays a dual role: Stripe acts as a subprocessor when it processes payments on the coach's behalf, and as an independent controller for its own fraud-prevention and legal-compliance purposes. We state this the same way everywhere it appears.
The Vercel Speed Insights telemetry described here is processed by Vercel as a subprocessor that hosts and serves Hubabble. The single canonical list of subprocessors is the Subprocessor List (subprocessor-list.md); the Privacy Policy and the DPA reference it, and any inline summary (including the one below) must match its live, imminent, and future split. For convenience, the current subprocessors include: Neon (database of record), Vercel (hosting, edge, and Speed Insights telemetry), Stripe (platform billing, with client payments to follow), Google (per-coach calendar features), Resend (transactional and document email; our email provider can record delivery and engagement events such as opens and clicks where that is enabled), AWS S3 in AWS region us-east-1 (US East, N. Virginia) (storage of signed documents), Inngest (background jobs), and Cloudflare (DNS and inbound email). The white-labeled video provider also acts as a subprocessor; it is intentionally not named on coach- or client-facing surfaces. The Subprocessor List is authoritative; if anything here diverges from it, the Subprocessor List controls.
Note on email tracking: for emails Hubabble sends through Resend (such as confirmations and document/e-sign notifications), our email provider can record delivery and engagement events such as opens and clicks where that is enabled. The send path does not turn tracking on by default. That is message-level tracking inside email, not website cookies, so it is governed by the Privacy Policy and your email client rather than this cookie notice. We flag it here only so the two documents do not appear to contradict each other.
9. Managing cookies in your browser
You can control cookies through your browser settings: you can see what is stored, delete cookies, and block or limit them. Most browsers also offer a "do not track" setting and, increasingly, a Global Privacy Control signal. Today we do not run the kind of tracking that those signals are designed to stop, so there is nothing for them to opt you out of. If we add such tracking in the future, Section 7 governs how we will honor those signals.
If you block or delete essential cookies, parts of Hubabble (such as signing in or submitting a secure form) may not work.
10. Changes to this notice
We will update this notice when our use of cookies or telemetry changes, and always before we add any non-essential analytics or advertising technology. Material changes will be reflected in the Effective Date and Version at the top, and we will tell you in-product or by email.
11. Contact
Questions about this notice or about cookies and tracking can be sent to:
Hubabble, LLC Attn: Privacy 403 Portway Avenue, Suite 300 Hood River, Oregon 97031 Email: privacy@hubabble.com