Privacy Policy

Scope of Personal Information Collection and Use

iisacc.com (the “Website”) offers optional account access. Registration asks for an email address, password, display name, User ID and acceptance of the Terms of Service; product email consent is optional. Sign-in verifies the password and a six-digit email code. A signed-in user may edit their display name, profile photo and optional author profile. Identity documents, a street address and a date of birth are not requested for the account profile. Amazon Cognito stores the email address, an internal random user identifier, email-verification state, token state, and authentication security metadata on the Operator’s behalf, while Amazon Simple Email Service processes the destination address to deliver the six-digit one-time code. Cognito verifies that code and maintains the resulting session. Mere access to and viewing of the Website does not create an account; account registration requires an explicit sign-up submission and email verification. If the Vincent direct-purchase flow is enabled, the Website separately maintains a limited transaction-entitlement record so that payment confirmation, revocation, expiry, download limits, version access, and installer integrity can be enforced. That record contains the payment provider name, provider transaction and any applicable captured-payment identifiers, transaction currency, total and post-credit grand total, a random entitlement identifier, token expiry, download-link count and timestamps, revocation state, and the applicable retention deadline. The verified iisacc account email is additionally stored with delivery status, bounded attempt metadata, Amazon SES message ID, and timestamps solely to send and audit the order-specific download-page link. For products with online license validation, the Website associates the account subject, normalized verified email, fixed product identifier, entitlement identifier, key generation and secret version, issuance or expiry and revocation state, and a one-way HMAC digest of the license key. The plaintext key is reconstructed only by the application server for the authenticated dashboard and transactional delivery email and is not stored in Aurora. When the product’s License Manager requests validation, the server processes the submitted email, fixed product identifier, license key, and ordinary connection address only to return the license decision and prevent automated guessing. Invalid attempts retain only an HMAC-pseudonymized requester key, count, and timestamps; the raw address and submitted key are not placed in the rate-limit record. Paddle separately processes the billing email entered in checkout for its receipt and merchant-of-record functions. These operational records are not analytics inputs and do not contain payment-card or payment-account credentials, billing country, address lines, city, region, or postal code.

An optional display name is stored in the Redis profile record linked to the internal account identifier and displayed within the signed-in account area. A user may edit or clear it at any time. It is not a verified legal name or an authentication identifier and is not sent to analytics or advertising providers.

An optional author profile contains only the details the user supplies: full and component names, a pen name, biography, organization and organization ID, department, team, job title, contact email, phone number, language tag, time zone, country code, region, city, HTTPS links and external identifiers. These fields are stored in the Redis profile linked to the verified account identifier and are available through authenticated account and app sessions. They are not verified legal identity, a new sign-in method or proof of ownership. Compatible iisacc apps may embed this information in file author metadata, which can be read by recipients of those files. The user can edit or clear the current account fields; doing so does not change copies of files already created or shared. Authentication tokens are excluded from author-profile responses and file metadata. This information is not supplied to analytics or advertising providers.

An optional profile photo is processed only to display the image selected for the account. The Website accepts JPEG, PNG, and WebP images up to 4 MiB, applies image orientation, center-crops and resizes the image to 1024 × 1024, removes original image metadata, and stores a re-encoded WebP file in private Amazon S3 storage. It stores the current image URL, content hash, and update timestamp in a Redis profile record linked to the internal account identifier; it does not persist the uploaded original or its original filename. The normalized image is available through a public Website URL: anyone with that URL can view it without signing in, and the Website serves it with a one-year browser and shared-cache lifetime. Replacing a photo updates the current account reference, and removing a photo clears that reference. These actions do not automatically delete earlier stored image objects, disable their public URLs, or remove copies already cached. Profile photos and their account references are not provided to the Website analytics or advertising pipelines.

Optional account integrations

A signed-in user may connect a Google, Apple, GitHub, Hugging Face, Facebook, Instagram, Threads, LinkedIn, X, YouTube, Discord, Reddit, Twitch, Pinterest, or Mastodon account through that provider’s official OAuth or OpenID Connect flow. The Website requests basic identity, profile, and email information. Pinterest additionally requests board and Pin read/write permissions for image and video upload authorization; connecting does not publish content. YouTube additionally requires read-only account authorization to retrieve the chosen channel; the connection retrieves only channel profile information. It does not collect the external account’s password or request private repository, file, message, inference, job, or billing permissions. Optional public activity and user-selected history imports are described separately below. Depending on what the provider shares, the account integration record contains the provider’s stable account identifier, email and verification state, display name, username, profile-photo URL, profile link, Apple private-relay email state, selected channel or server information, provider biography or description where shared, and connection and update timestamps. The Website stores this last received profile snapshot and its association with the iisacc account in server-side Redis; it does not continuously synchronize the external profile.

Google and Apple can be used to sign in only when their verified provider identifier is already linked to an iisacc account. For an unlinked identifier, the Website uses the shared name and verified email to prefill the existing registration form. The user must complete iisacc registration and email verification before a new account and link are created. Matching email addresses alone do not merge accounts or authorize sign-in. GitHub, Hugging Face, and the social integrations are not sign-in providers and are used only for account integration. Connecting an account does not change the iisacc email, password, or existing profile. The display name is copied to the iisacc profile only when the user explicitly selects Use this name in iisacc. The Website does not edit the external account’s profile.

OAuth credentials needed for supported provider-side revocation or authorized Pinterest uploads are encrypted on the server before storage in Redis. They are not returned to the browser or included in analytics, advertising, or file author metadata. Hugging Face, Instagram, Threads, LinkedIn, and Twitch OAuth tokens are not permanently retained: they are used transiently to verify identity and retrieve the profile. Disconnecting these transient connections removes the iisacc snapshot; the user can remove the provider app grant in that provider’s connected-app settings. The Twitch access token is validated, used for the profile request, and then immediately revoked; no ongoing Twitch OAuth session is maintained. Pinterest access and refresh tokens are encrypted in the same server ledger. Its upload consent metadata is displayed with the account connection. Disconnect deletes the saved Pinterest snapshot and credentials; the provider grant can be removed in Pinterest settings. Other supported connections use the official revocation or unlink endpoint before removal. YouTube requests read-only channel access and stores the selected channel’s details; it does not collect watch history through this connection. Instagram supports professional accounts. Mastodon currently supports mastodon.social. Profile-photo URLs refer to provider-hosted images rather than copies in the Website’s image storage. Viewing such an image sends ordinary connection information to its host; the Website sets a no-referrer policy on these account images. Account integration information is used only to provide the requested account connection, profile display, explicit name import, and eligible linked sign-in. The connection snapshot is not sold or used for advertising. Activity-based content interests require separate optional collection described below. The Website’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

The current account integration record and its credentials remain until the connection is removed. Authentication attempts expire after ten minutes and cannot be reused. Refresh details starts a new provider authorization flow to update the stored snapshot. Disconnect removes the stored connection, profile snapshot, ownership association, and retained credentials. For providers with supported remote disconnect, the Website first requests revocation through the provider’s official API; if that request fails, it retains the connection so the user can retry. Hugging Face disconnect removes the local record; the user can separately remove provider-side app access through Hugging Face Connected Applications. Removing a connection does not delete either account or undo an earlier explicit name import. Provider-side data and authorization records remain subject to that provider’s own account controls and policies.

Optional personalized content activity

Activity collection is disabled by default, including for existing connected accounts. In Account → Personalization → Sources, the user may separately enable collection for each connected provider. This choice permits only private content-personalization use within the iisacc account. It does not change sign-in, marketing-email consent or analytics/advertising choices. No activity is sold, supplied to analytics or advertising providers, included in public author metadata, or used to train a general-purpose AI model.

On a requested Sync public activity, the Website uses the official GitHub API for public owned and starred repositories, including languages and topics, and official Hugging Face APIs for public owned models, datasets, Spaces and liked repositories. It verifies the provider’s fixed identifier before collecting these records. Hugging Face public collection does not retain or require a Hugging Face OAuth token. Neither provider’s aggregate download statistics are treated as the user’s downloads. Apple activity is not collected.

Individual optional source choices permit GitHub public watched repositories, push, pull request, issue, review and fork events, and bounded repository descriptions, or Hugging Face public collections, their titles and descriptions, and collected models, datasets and Spaces. This expanded collection is disabled for existing and new connections until explicitly selected. Deselecting a source option removes its saved observations, including imported history for a deselected history type; disabling descriptions removes description-derived keywords. The Website does not collect commit contents, issue or review text, private repositories or private collections. Provider pagination, response limits and history availability can make the result a partial sample; the account screen identifies this condition.

Google sign-in’s basic identity permissions do not provide Search or YouTube watch history. Direct Data Portability history access is not enabled. After separately enabling Google personalization, the user can choose a Google Takeout JSON array containing Search or YouTube watch history. Hugging Face personal downloads can similarly be imported from a user-supplied download journal. Imports require confirmation that the selected data belongs to the linked account; this acknowledgement is not independent provider verification of the file. Files must be no larger than 512 KiB and contain supported records. Users should review the file and remove activity they do not want to share before uploading it. Unsupported records reject the whole request. The uploaded file, filename, full source document, Google Search URL query parameters and unrelated export fields are not retained.

Stored observations contain the provider, resource identifier and type, action, bounded title, activity and observation timestamps, provenance (official API or user import), deduplication identifier, matched content topics and keyword strings. Search titles may include the query submitted by the user. Observations, explicit preferences and the account-owned interest projection are encrypted before storage in Redis. The projection combines a content-topic vocabulary with arbitrary public tags, resource names, and keywords from descriptions or selected search and viewing records. Owner-only account summaries may therefore include keywords taken from a selected query or title. Overlap requires evidence from at least two distinct providers. These are content signals rather than verified traits; no health, religion, political-view or other sensitive-trait classifier is applied.

Users can separately save Interested in and Not interested in keyword lists, including interests absent from provider activity. Not-interested keywords are provided explicitly by the user and are never inferred from inactivity, missing favorites or removed stars. They override the corresponding collected interest signals. Source disconnection or collection disabling removes that source’s inferred contribution while preserving the user’s explicit lists. Explicit lists remain until edited or deleted; Delete all removes them together with activity and collection choices. At most 200 explicit keywords per list and 500 final interest keywords are stored, with explicit interests first.

At most 500 observations per provider are retained. A bounded API sample may be partial and is labelled as such. Imported observations expire 180 days after the activity; current public ownership and favorites expire 180 days after their latest observation. Expired observations are excluded from account reads immediately and removed by daily maintenance. Collection runs only at the user’s request, with no background history collection. The user can download their retained observations, Disable and delete activity for one source, or Delete all activity and disable personalized collection. Successful account disconnection also deletes that provider’s local activity and recalculates the account’s interests. A failed provider revocation leaves both connection and activity available for retry. Removing data in iisacc does not delete the source provider’s own records; copies in existing operational backups follow the normal backup lifecycle.

The Website no longer accepts product preregistrations. Existing consented preregistration records remain subject to their original purpose limits, retention deadlines, and withdrawal rights. These records contain the normalized address, consent version and timestamps, form source, request count, delivery state, bounded attempt count, claim timestamp, any Amazon SES message ID and error category, and record-retention deadlines. Existing abuse-limit records contain only a pseudonymous requester key and hourly count; raw network addresses and HMAC secrets are not stored in signup records or exposed to the browser.

Analytics

The Website uses first-party, anonymous, aggregate behavioral analytics. Its purpose is to improve product presentation, navigation, sales copy, marketing material, and page performance, not to identify visitors.

Eligible public pages separately offer optional analytics and advertising measurement. Google Tag Manager remains unloaded until a visitor explicitly grants at least one category. Analytics & experience can enable Google Analytics, Microsoft Clarity, and Hotjar. Advertising measurement can enable Google Ads, TikTok Pixel, and LinkedIn Insight Tag. Meta Pixel is excluded and the Website contains no connect.facebook.net loader, fbq() call, Meta Pixel ID, Meta event, advanced matching field, or Meta Conversions API integration. Global Privacy Control or Do Not Track blocks both optional categories. The Website contains no external advertising placement or advertising iframe.

For eligible public pages, a small first-party client may report only an allowlisted route template, a fixed Website-defined call-to-action identifier, a coarse scroll-depth milestone, a coarse 8-by-6 pointer-grid count, an engagement-duration bucket, a performance bucket, a document or internal-navigation exit classification, and an aggregate count. The first-party analytics contract expressly forbids names, email addresses, telephone numbers, resident registration or other government identifiers, passport numbers, card or payment credentials, precise or coarse location, medical or health information, biometric information, dates of birth, postal addresses, account or session identifiers, cookie or storage values, IP addresses, user agents, device classes, languages, screen dimensions, full URLs, query strings, hashes, referrers, form or input values, DOM text, CSS selectors, error text, transaction or entitlement identifiers, access tokens, and free text. Unknown or additional fields are rejected. The client stores no analytics cookie or persistent browser identifier, cannot calculate unique visitors, and cannot create or join a visitor-level history. Requests use a cookie-free same-origin fetch and the analytics server route does not resolve account sessions or inspect network or browser identity fields. It measures Website surfaces, not people.

Account pages, Vincent checkout completion at and below /Store/Vincent/Checkout, Paddle transaction links at and below /Store/Vincent/Paddle, private downloads at and below /Store/Vincent/Download, unsubscribe paths, API paths, and private paths send no browser analytics request. The Account browser sends no first-party analytics request. The server authentication flow separately increments fixed daily counters only when it receives a valid-form Continue submission and when Cognito verification succeeds; those counters contain no email, code, account, cookie, device, network, or failure-reason field and are not unique-person counts. The Website does not serialize or observe form fields, private tokens, or user-created content for analytics. AWS Amplify necessarily receives ordinary connection metadata to deliver HTTPS, but the analytics application does not read, copy, hash, persist, or join that metadata into its dataset.

The first-party AWS client does not use cookies, local storage, IndexedDB, or a visitor identifier.

The optional tag path runs only on https://iisacc.com or https://www.iisacc.com, an allowlisted public route, and a URL without a query string or fragment. Its version 2 preference cookie is scoped to iisacc.com so one explicit choice applies to both first-party production hosts; earlier host-only choices require a fresh explicit selection. Its data layer contains only the canonical apex, query-free pathname, an allowlisted route template, and the two consent states. It does not receive account, name, email, telephone, form, purchase, payment, transaction, entitlement, free-text, DOM-text, exact-location, user-provided-data, or hashed-identifier fields. The Website does not issue a purchase-conversion receipt or send a transaction ID to GTM. Advertising personalization, enhanced conversions, advanced matching, and server-side conversion APIs remain disabled.

When a visitor grants an optional category, the selected providers necessarily receive ordinary network and browser metadata when their scripts are downloaded and may set cookies under their own policies. Those provider datasets are not joined to the first-party AWS aggregate dataset. Withdrawing consent sends denial state, expires known first-party vendor-cookie names, and reloads the page when necessary. The Website always expires the _fbp and _fbc cookie names and removes an in-page fbq value without reading or transmitting it. Storage located solely on a third party’s domain remains subject to that provider’s deletion controls.

Anonymous event batches and the two fixed authentication counters for the first-party AWS path remain in an encrypted Amazon SQS buffer for no more than six hours during ordinary processing; failed batches remain in an encrypted dead-letter queue for no more than one day. AWS Lambda immediately increments fixed daily counters in Amazon DynamoDB without storing the individual event or a visitor identifier. Those counters are marked to expire after 180 days and DynamoDB then removes them asynchronously. Operational CloudWatch logs contain status and error categories only and must not contain analytics request bodies. Because SQS delivery is at least once, a rare retry may increment a counter more than once; the counters are directional Website signals, not exact people or transaction totals. Operator reports suppress exact-route and authentication values below five and do not read or join account, order, purchase, country, device, network, form, or third-party data.

Passwordless account access uses a signed, HttpOnly, SameSite Strict challenge cookie for no more than ten minutes and separate HttpOnly, SameSite Lax ID-token and refresh-token cookies. The ID token expires after one hour and the refresh token after 30 days; signing out revokes the refresh token and deletes both browser cookies. These cookies authenticate the requested account and are not available to client-side scripts. When a purchaser explicitly starts Vincent checkout, the server sets a separate random HttpOnly, SameSite checkout-security cookie for that checkout for up to seven days. The cookie binds the server-created Paddle transaction to the browser that started it, allowing the same unpaid transaction to reopen after an overlay close or refresh instead of creating another payment. A browser already presenting 12 valid checkout cookies cannot start another checkout. An explicit restart first asks Paddle to cancel a known draft or ready transaction and then records cancellation and abandonment timestamps; paid or completed transactions are sent to completion recovery. Legacy states without a known provider transaction may be explicitly abandoned but remain until retention so a racing provider-confirmed completion can still be reconciled. Successful browser reconciliation deletes the matching cookie only; webhook-first issuance leaves that cookie until browser reconciliation or expiry. The server temporarily records each state’s SHA-256 hash, Product and Price IDs, catalog currency and base amount, provider transaction identifier, security, cancellation and abandonment timestamps, and an HMAC-pseudonymized requester network address to limit abuse and prove that the server issued the state. A second completed payment for an account never replaces its existing entitlement; a limited refund-outbox record stores the provider transaction, original and duplicate entitlement identifiers, pseudonymous account subject, refund status, adjustment identifier, error category and timestamps so a full refund can be requested or reviewed without issuing duplicate access. None of those operational fields enters analytics or advertising. Paddle.js may use checkout storage, cookies, device and network information as necessary to display and secure the payment form under Paddle’s own notices. When an order access link is opened, its fragment token is removed from the address bar. An active token is exchanged for a separate HttpOnly, SameSite Strict download-access cookie; an inactive token returns only a general status until the signed-in account proves ownership. The active-token cookie contains the signed order token, is scoped to /Store/Vincent/Download, expires with the entitlement or after 30 days at the latest, and the page’s “Sign out and forget browser access” action revokes the account session and deletes it. The iisacc authentication, checkout-security, and download-access cookies are not used for analytics or advertising.

Third-Party Services and Payment Processing

Where the Website offers paid solutions, Paddle acts as the merchant of record and processes payment credentials, billing details, payment authentication, tax calculation, receipts, customer credit, refunds, and chargebacks in Paddle Checkout. The Website receives a client-side completion notice for user experience only; entitlement issuance requires a completed Paddle transaction verified through Paddle’s server API or a signed transaction.completed webhook. The Vincent entitlement record deliberately persists only the Paddle transaction, any applicable captured-payment, customer, price, currency, total, post-credit grand total, and webhook-event identifiers together with the limited delivery fields described above. It does not request or persist card numbers, payment-account passwords, billing country, postal addresses, address lines, city, region, precise location, passport or government identifiers, or medical information. AWS hosts the Website and server routes and processes email-only account authentication, code delivery, Vincent purchase-link delivery, previously requested product launch/download messages, and anonymous aggregate web analytics through AWS Amplify, encrypted Amazon SQS queues, AWS Lambda, Amazon DynamoDB, and Amazon CloudWatch. AWS also processes the private installer objects, checkout-state and requester-pseudonym records, entitlement records, purchaser email-delivery records, existing preregistration and abuse-limit records, payment-event identifiers, revocation records, and download-event timestamps on the Operator’s behalf through AWS Amplify, Amazon Aurora PostgreSQL, Amazon S3, AWS Secrets Manager, and EventBridge Scheduler. A private installer object is disclosed only through a short-lived presigned URL after the entitlement and release checks pass. Optional profile images use the separate public image path described above. No account, purchaser, support, preregistration, payment, or delivery field is provided to the Website analytics pipeline or an advertising provider.

Information Voluntarily Provided by Users

Public reading does not require personal information. A user who chooses account access provides an email address for code delivery, identity verification, session continuity, and—after that account adds free Vincent access or holds a historical paid Vincent order—transactional download-link delivery and access recovery. Current Vincent acquisition is free and does not send the account to Paddle for payment. Historical paid order, refund, and receipt records retain their original amounts and are kept separately from free access. Paddle separately processes the billing email entered in checkout for payment and receipt functions; iisacc does not substitute that editable billing address for the verified account address when sending Vincent access. An existing preregistration address was provided under its own separate consent and is used only for the single requested launch message and official download link; it is not reused for a newsletter, another product, account access, advertising, resale, or behavioral profiling. Account, support, and existing preregistration addresses are not substituted for one another. Vincent one-to-one outreach uses separately reviewed public professional contact points only where the applicable law and channel rules permit that contact. The private operator ledger retains the contact point, public-source URL, relevance note, message state, provider evidence, and bounce or opt-out state. The suppression service stores only a SHA-256 recipient/channel key protected by an HMAC-signed unsubscribe link, channel, request source, count, and timestamps, not the address, handle, message, or research note. The Operator uses these records only to document relevant outreach, prevent duplicate messages, honor opt-outs, and suppress bounced contacts, and does not create a behavioral profile. A user may also voluntarily provide information via explicit contact channels when submitting inquiries, bug reports, or refund requests. In such cases, the Operator processes the voluntarily provided information solely for the purpose of responding to the request and resolving the issue. The Operator retains such information only for the period necessary to complete the request and, unless retention is required by applicable law, deletes or anonymizes it without undue delay after the purpose has been fulfilled. The Operator does not use account or support information for marketing, resale, behavioral profiling, or disclosure to third parties beyond those purposes.

Retention Period and Deletion of Personal Information

The Cognito email account remains until the user requests deletion or the Operator removes an inactive account under an announced retention rule. Authentication challenge sessions expire within minutes, ID tokens after one hour, and refresh tokens after 30 days. Cognito and AWS security logs may be retained for the applicable AWS service log-retention period to prevent abuse and investigate authentication failures. First-party anonymous analytics retain no user-level history: encrypted transient event buffers expire within six hours or one day for failed delivery, and fixed daily aggregate counters are marked for asynchronous deletion after 180 days. The optional-tag preference expires after no more than 180 days. Data created by a consented optional provider is subject to that provider’s published retention and deletion controls; withdrawing Website consent stops future Website loading but cannot itself delete storage located solely on the provider’s domain. Checkout-state and requester-pseudonym records carry a 30-day retention deadline whether or not payment completes. License-validation requester HMAC windows are deleted after 24 hours. An account product license record follows the linked product entitlement and is invalidated when that entitlement or key is revoked; transaction, supply, dispute, and mandatory retention requirements may limit immediate deletion of the underlying entitlement. An existing preregistration address is retained until the requested launch message is sent or for 24 months after the latest consent, whichever occurs first; after the requested message is sent, the address and delivery audit are deleted within 30 days. Preregistration requester HMAC rate-limit windows are deleted after 24 hours. A withdrawal request deletes the preregistration address without waiting for those deadlines. Vincent order, payment-confirmation, supply, and purchaser email-delivery records carry a five-year retention deadline from creation so the Operator can maintain transaction evidence and purchaser access within the period applicable to contract, payment, and supply records. Outbound contact and research fields are removed when they are no longer needed to audit the outreach, but bounce and opt-out suppression is retained while Vincent outreach remains possible so the same contact channel is not approached again. Complaint or dispute material may be retained for the period required to resolve the matter and for any mandatory legal period. After the applicable deadline and any legal hold end, the records are deleted or anonymized. Download-event and email-delivery records follow the parent entitlement’s lifecycle. Voluntarily provided support information is retained only as long as necessary to complete the request unless a mandatory retention obligation applies.

User Rights

Users, as data subjects, may have statutory rights under applicable data protection laws, including rights relating to access, correction, deletion, or restriction of processing. An account request should be made from the relevant verified email address so that the Operator can locate the Cognito account without disclosing another user’s information. An existing preregistrant may request withdrawal from the registered address through the Website support contact; the address is then removed from the launch queue. A purchaser should provide the Paddle transaction or payment identifier and sufficient proof of the requester’s relationship to the transaction so that the Operator can locate the limited entitlement record. Deletion or restriction may be limited where transaction preservation, dispute handling, fraud prevention, or another mandatory legal obligation applies.

Inquiries and Handling Principles

The Operator handles privacy-related inquiries in accordance with this Privacy Policy and applicable law. Any communications regarding privacy matters shall be submitted through the contact method posted on the Website, and the Operator will respond within a reasonable period where a response is necessary. The Operator will not disclose an entitlement or transaction record unless the request can be reasonably matched to the relevant purchaser.

Legal Compliance and Policy Updates

The Operator complies with applicable data protection laws, including the Personal Information Protection Act of the Republic of Korea, to the extent relevant to the Website’s operating model. This Privacy Policy is intended to describe, in definitive terms, the scope and limits of personal information processing based on the Website’s actual operation. If laws change or the Website’s functions or processing practices change, this Privacy Policy may be amended. Any material additions, deletions, or modifications will be announced on the Website prior to taking effect within a reasonable notice period. This Privacy Policy is effective as of August 13, 2026. The optional account integration disclosures were added on October 2, 2026, before provider connections were activated. Social account integration disclosures were expanded on October 6, 2026. Optional personalized-content collection disclosures were added on October 2, 2026 before this feature was enabled.