Cookie Policy

Cookies are small files a website places on your computer or phone. They let a site recognise your device, remember your choices and understand how it is used. Session cookies disappear when you close your browser; persistent cookies stay until they expire or you delete them. First-party cookies are set by us; third-party cookies are set by another company whose service we use.

We also use browser storage (localStorage and sessionStorage), which works like a cookie for this purpose but holds more data and is never sent to our servers automatically. Where this policy says “cookies”, it includes both.

Strictly necessary — sign-in session. Set by our authentication provider (Supabase). Cookies whose names begin sb- and end -auth-token keep you signed in and let us check, on every request, that you are allowed to see what you are asking for. First party. Lasts for your session and is refreshed while you are active. The Site cannot work without it.

Strictly necessary — current organisation. A first-party cookie named active_org_id remembers which organisation you were last working in, so you land in the right place. It holds an identifier only, and is checked against your real memberships before it is used.

Functionality — your preferences and drafts. Browser storage on your device that remembers things like your theme, an unfinished onboarding form or the last screen you were on, so you do not lose work. It stays on your device.

Analytics — product usage (PostHog). A cookie and browser-storage entry whose names begin ph_ and end _posthog. It gives your browser a random identifier so we can count visits and see which features are used and where the product fails. We record pages viewed and a limited set of events we have chosen; automatic click capture is switched off. Set by PostHog, acting as our service provider. Lasts up to a year.

Analytics — page statistics (Vercel Web Analytics). Aggregate page-view counts from our hosting provider. It is designed to work without cookies or a persistent identifier for your browser.

Diagnostics — error tracking (Sentry). When something breaks, Sentry receives the error, the page it happened on and basic browser and device details so we can fix it. It does not set an advertising or tracking cookie.

Payments (Stripe). When you pay, you are sent to a page hosted by Stripe. Stripe sets its own cookies there for fraud prevention and to complete the payment, under its own policy. We do not receive your card details.

We do not use advertising or retargeting cookies, we do not run third-party ad trackers or social-media tracking pixels on the Site, and we do not use session-replay tools that record what you do on screen. If that ever changes, we will update this policy before it does.

Your browser. Most browsers let you see, block and delete cookies and site storage from their settings. Blocking the strictly necessary cookies means you cannot sign in. Blocking the analytics ones does not affect how the Site works. You will need to repeat this on each browser and device you use.

Opting out of analytics. If you would like us to stop measuring your use of the Site, email hello@collectiv-tech.com from the address on your account and we will arrange it. Browser privacy tools and content blockers that block PostHog will also stop it.

Do Not Track. We do not currently change our behaviour in response to a browser’s “Do Not Track” signal, because there is no common standard for doing so.

We will update this policy when the cookies or similar technologies we use change. The effective date above shows when it was last revised, so please check back from time to time.

If you have any questions about this policy, email hello@collectiv-tech.com.