DRAFT — revised 15 September 2026. Confirm actual storage, expiry and provider behaviour by browser testing before publication.
Legal
Cookie Policy
We use a small number of cookies to keep you signed in, process payments, and (with your consent) understand how the product is used. Strictly necessary cookies are set without consent under PECR reg. 6(4). Optional analytics are gated by the consent choice; verify this in browser/network acceptance before publication. Marketing storage must not be introduced without the required consent. Stripe is reached through hosted payment redirects; test that Stripe scripts/cookies are not set on unrelated pages.
| Name | Category | Purpose | Expiry | Provider |
|---|---|---|---|---|
| sb-*-auth-token | Strictly necessary | Authentication session, set after magic-link login | Session/refresh configuration must be verified before publication | Supabase |
| __stripe_mid / __stripe_sid | Strictly necessary | Payment fraud prevention only where necessary on Stripe-hosted Checkout / Portal; not permission for site-wide tracking | Up to 1 year | Stripe |
| ph_*_posthog | Analytics | Pseudonymous product analytics — feature usage, funnel events | 1 year | PostHog |
| cky-consent | Strictly necessary | Stores your consent preferences | 1 year | BridgeBot (first-party consent storage) |
Managing your preferences
BridgeBot also stores a copy of consent preferences in localStorage under bb-consent-v1 until cleared or replaced. This is first-party storage, not evidence that CookieYes is installed. Withdraw consent at any time via the “Cookie settings” link in the footer, or by clearing cookies in your browser. Blocking strictly necessary cookies will break sign-in and checkout.