Which cookies we set and which ones we do not.

We group cookies into three categories. Essential cookies are required for the platform to function and cannot be opted out without breaking sign-in and core features. Analytics cookies measure how the product is used so we can fix what is broken. Marketing cookies follow you around the web to retarget ads. Below is the current state of each category by name and by vendor.

These cookies make the platform work. We set the NextAuth session cookie when you sign in. We set a CSRF token cookie to block cross-site request forgery on form posts. We set a theme preference cookie so the interface remembers light or dark mode between visits. Our hosting provider Vercel may also set load-balancer and edge routing cookies that are required for the site to serve traffic. You cannot opt out of essential cookies because the platform stops working without them. If you do not want essential cookies, do not sign in.

We use PostHog for product analytics and session replay, and it runs only after you click "Accept all" on the banner. It is also gated on our own configuration, so it loads only in environments where we have PostHog turned on. When active, PostHog sets its own cookies whose names begin with ph_ alongside a matching localStorage entry to remember your analytics session, records how you move through the product, and captures session replays with every input field masked so we never see what you type. We use this to find what is broken and confusing, not to build an advertising profile. Choose "Essential only" and PostHog does not load and sets no cookie. We do not run Plausible or Google Analytics.

We do not run third-party ad pixels. No Meta pixel, no Google Ads conversion tag, no LinkedIn Insight tag, no TikTok pixel, no retargeting cookie of any kind. We do not sell your data to advertising networks. If that ever changes we will say so here in plain language and we will ask for your consent through the banner before the first marketing cookie is set.

Some third-party services set their own cookies when you actively use them inside our product. Stripe sets cookies on its hosted Checkout pages when you go through payment, which Stripe uses for fraud prevention and session continuity. Plaid sets cookies inside the Plaid Link iframe when you connect a bank account, which Plaid uses to keep the connection flow secure. Crisp powers our support chat. When the chat widget loads, which happens for signed-in users and for visitors who have made a cookie choice on the banner, Crisp sets its own cookies to keep your conversation and your place in it. These cookies are governed by the privacy policies of Stripe, Plaid, and Crisp respectively.

Use the banner at the bottom of the page to set your preference. Click "Essential only" to limit us to functional cookies. Click "Accept all" to also allow PostHog analytics and session replay on top of the essential set. You can also block or delete cookies in your browser settings at any time. In Chrome, Settings then Privacy and security then Cookies and other site data. In Safari, Preferences then Privacy. In Firefox, Settings then Privacy and security. Blocking essential cookies will sign you out and break parts of the app.

Some browsers send a Do Not Track signal in the request header. Because analytics and session replay turn on only when you click "Accept all", a browser that sends Do Not Track and has not accepted all never gets a PostHog analytics or replay cookie. Essential cookies still need to run for sign-in to work, so the Do Not Track header does not turn those off.