Cookie Notice

This Cookie Notice explains how TreeHaous, Inc. (“TreeHaous,” “we,” “us,” or “our”) uses cookies and similar technologies on the Services. Capitalized terms used but not defined here have the meanings given in the Terms of Service. This Notice supplements, and is incorporated into, our Privacy Policy.

1. What Are Cookies and Similar Technologies

Cookies are small text files stored on your device when you visit a website. Similar technologies include software development kits (SDKs) in mobile apps, local storage, pixels, and tags. We refer to all of these collectively as “cookies” in this Notice. Cookies may be set by us (“first-party”) or by a service provider acting on our behalf (“third-party”). They may last only for your session (“session cookies”) or persist across visits (“persistent cookies”).

Mobile apps. In our mobile apps, the relevant technologies are generally SDKs and device identifiers rather than browser cookies, and the controls available to you are operating-system and device-level — such as the device’s app-tracking permission settings and the ability to reset or limit the device advertising identifier — rather than browser cookie deletion. We describe these controls in Section 4.1.

2. How We Use Cookies

We use cookies to operate and secure the Services, remember your preferences and session, understand how the Services are used, and improve features. We group cookies into the categories described below. As of the Effective Date, we do not use cookies for advertising or for cross-context behavioral advertising.

3. Categories of Cookies We Use

Category — Purpose — Examples / Provider — Duration

Strictly Necessary — Enable core functions such as signing in, maintaining your session, security, load balancing, and remembering your cookie choices. The Services cannot function properly without these. These are not subject to opt-out. — First-party session/auth (e.g., th_session, th_csrf); CDN (Cloudflare) — Session / up to 12 months

Preferences — Remember choices you make, such as saved settings and display preferences, to personalize your experience in a basic way. — First-party (e.g., th_prefs) — Up to 12 months

Analytics / Performance — Help us understand how Users interact with the Services so we can measure performance, debug, and improve features. This supports the Behavioral Telemetry described in the Privacy Policy. As of the Effective Date, analytics cookies are not used to personalize content beyond the User’s own opt-in Canopy Feed signals; any future use for model-based personalization is gated as described in the Privacy Policy. — First-party and/or a third-party analytics provider — Up to 24 months

Advertising — Not used as of the Effective Date. We do not currently deploy advertising or cross-context behavioral advertising cookies. If we do in the future, we will update this Notice and provide any required opt-out. — None — Launching advertising or promoted-placement features will introduce advertising cookies — or, in the mobile apps, the use of a mobile advertising SDK or the device advertising identifier for advertising purposes — and may create a “sale” or “share” under certain state privacy laws. This triggers the cookie-banner consent/opt-out build, the Privacy Policy § 4.1 and § 4.2 review, and the Fair Housing review for ad targeting.

3.1 Cookie Audit; Publication Gate

This Notice may not be published until a cookie/tag scan of the deployed site has been completed and the Section 3 table has been reconciled to the scan results. The inventory is then re-audited on a defined cadence and whenever a new tag or SDK is added. The scan must identify functional and embedded third-party cookies and tags — not only advertising cookies — including those set by embedded third-party content such as 3D-tour or video players, mapping providers, font or CDN providers, and social embeds. Such tags can appear without the team’s awareness and can render the inventory, or the “no advertising cookies” statement, inaccurate.

The accuracy of the “no advertising / no cross-context behavioral advertising cookies” statement in Sections 2 and 3 depends on the audit confirming that no third-party tag is functioning as an advertising or CCBA cookie. If the scan identifies any such tag, the Advertising category and the sealed-compartment triggers above apply, and this Notice must be updated before publication. The audit and ongoing tag governance occur under TreeHaous’s internal procedures.

4. Your Choices and How to Manage Cookies

4.1 Browser and Device Controls. Most browsers let you view, manage, block, and delete cookies through their settings. In mobile apps, the relevant controls are operating-system and device-level rather than cookie deletion — for example, your device’s app-tracking permission settings and the option to reset or limit the device advertising identifier. Because these controls are specific to each browser, operating system, and device, refer to your browser or device help resources. Blocking strictly necessary cookies may cause parts of the Services to stop working.

4.2 Cookie Preference Controls. Where required by law or where we offer them, you can manage non-essential cookies through our in-product cookie controls.

4.3 Opt-Out Preference Signals. We honor browser-based opt-out preference signals, such as Global Privacy Control (GPC), where applicable law requires us to treat them as a valid request to opt out of “sale” or “sharing.” As of the Effective Date, we do not sell or share Personal Information through advertising cookies. This calibration is the same as the Privacy Policy’s sale/share gate: the scope of any GPC obligation is tied to the launch of advertising features or the integration of technology that could constitute a “sale” or “share,” and this Notice and the Privacy Policy state the same posture.

4.4 Analytics Opt-Out. Where we use a third-party analytics provider, you may be able to opt out through that provider’s tools, in addition to your browser controls.

4.5 Future Consent Mechanism. If advertising features and a cookie consent/preference mechanism are later deployed, the cookie categories in Section 3 will be mapped to that mechanism’s consent records, and this Notice will be updated accordingly. No such mechanism is required or represented as deployed today; whether a banner is deployed remains the publication-time confirmation in Section 4.2.

5. Relationship to the Privacy Policy

Information collected through cookies may constitute Personal Information and is handled in accordance with our Privacy Policy, including the sections on how we use and disclose information and your privacy choices and rights. To exercise privacy rights, use the single intake channel described in the Privacy Policy; this Notice does not create a separate request process.

6. Changes to This Notice

We may update this Notice from time to time, including to reflect changes in the cookies we use. We will post the updated Notice with a new “Last Updated” date and, where required, provide additional notice or obtain consent.

7. Contact Us

Questions about this Notice may be directed to accounts@treehaous.com or TreeHaous, Inc., 680 N Lake Shore Dr, Suite 110-2521, Chicago, IL 60611.