Cookie policy

Cookies are small text files a website stores in your browser. Related browser features such as local storage serve a similar purpose; we list both here for completeness.

• __sf_refresh - session refresh token. Set by our backend when you sign in. Strictly necessary: without it you would be logged out when your short-lived session expires. HttpOnly (not readable by JavaScript), SameSite=Strict, scoped to the /api/v1/auth path. Lifetime: 7 days.
• Auth flag cookie - a client-side cookie that only tells the app "a refresh token may exist" so it knows to attempt a session restore. Contains no personal data. SameSite=Lax. Lifetime: 7 days.
• Theme preference - your light/dark mode choice, kept in the browser's local storage (not an HTTP cookie, never sent to the server). Purely functional. Lifetime: until you clear your browser storage.
• sf_consent - your cookie consent choice (which categories you accepted, and when), kept in local storage. Strictly necessary: it is how we remember that you said no. Lifetime: until you clear your browser storage.
• sf_consent_progress - counters the consent banner uses to decide how prominently to ask, kept in session storage. Contains no identifiers. Lifetime: deleted when the tab closes.

The following entries are set only after you accept the "Analytics" category in the cookie consent banner. If you decline - or never answer - none of them are created and no analytics or error data leaves your browser.

• ph_*_posthog - PostHog product analytics. A first-party cookie and a local-storage entry (named after our project key) holding a random analytics identifier and session state, used to understand which features are used (page views, clicks, searches). Type: analytics. Lifetime: 12 months.
• Sentry error tracking - sets no cookies. With your consent, unexpected errors in your browser session are reported to Sentry together with technical context (browser version, the page you were on) so we can fix them.

Withdrawing consent via "Cookie settings" in the footer stops all analytics capture immediately; you can also delete the entries above in your browser settings.

Analytics is controlled by the consent banner and the "Cookie settings" control in the footer - no browser configuration needed. You can additionally delete or block cookies in your browser settings at any time. Because the strictly necessary entries are required for sign-in, blocking all cookies means you cannot stay signed in; browsing public pages works without any cookies at all.

For anything cookie-related, email legal@stackness.dev. How we handle personal data generally is covered by the Privacy policy.