| Strictly necessary | Remember your cookie choice (Accept / Reject / preference settings) so we don't re-prompt on every visit. | Relay (first-party, localStorage key relay.cookies) | 12 months from your last visit |
| Strictly necessary | Session authentication and CSRF protection on signed-in surfaces. | Relay (first-party) + Supabase Auth | Session |
| Functional | Remember your manually-chosen light/dark theme across visits and surfaces. | Relay (first-party cookie relay-theme-user + localStorage mirror) | 12 months |
| Analytics | Aggregated, anonymized page-view counts. Only loaded after you Accept on the cookie banner. | Vercel Analytics | Per Vercel's published policy (vercel.com/legal/privacy-policy) |
| Analytics | Core Web Vitals telemetry (LCP, INP, CLS) to detect performance regressions. Only loaded after Accept. | Vercel Speed Insights | Per Vercel's published policy (vercel.com/legal/privacy-policy) |
| Analytics | Product analytics: which pages you visit and which steps of signup and a session you complete, so we can find where the flow breaks. Session recording and autocapture are both switched off, and one-time links (magic links, password-reset links) have their tokens stripped before anything is stored. Only loaded after Accept. | PostHog (EU region, served first-party through relay.green/ingest) | Per PostHog's published policy (posthog.com/privacy) |
| Analytics | Session replay and heatmaps, so we can see where a page confuses people. Recorded with Clarity's Strict masking, which replaces all on-screen text and every form input with placeholder blocks before anything leaves your browser, so the replay shows layout and clicks but not content. We tell Clarity that advertising storage is denied, so its advertising cookies (MUID and the cookies that sync it) are not set. Only loaded after Accept. | Microsoft Clarity. First-party cookies _clck and _clsk; Microsoft may also set third-party cookies (CLID, ANONCHK, MR, SM) on its own domains. | Per Microsoft's published policy (privacy.microsoft.com/privacystatement) |
| Marketing | None today. The marketing category exists for future paid-campaign attribution; no marketing cookies are currently loaded. | None at this time | n/a |