Cookie Policy

What cookies are

Cookies are small text files that a website stores in your browser. Some expire when you close the tab; others stay until they expire or you clear them. They are used for everything from remembering you are logged in to counting how many people visited a page. This policy explains which ones Posthawk uses on posthawk.dev and on the app.posthawk.dev dashboard, what they do, and how you can turn them off.

Strictly necessary cookies

These cookies are required for the site to work — you cannot turn them off without breaking the product. We do not ask consent for them because the UK PECR and GDPR both carve out a necessity exemption.

• Session cookies set by Supabase Auth to keep you logged into the dashboard
• CSRF tokens used by the dashboard and API to prevent cross-site request forgery
• A consent preference cookie that remembers whether you accepted or rejected analytics, so we do not re-ask on every page load
• A Cloudflare Turnstile challenge token used on the newsletter and contact forms to block bots

Analytics cookies

We use two analytics tools to understand how visitors move through the marketing site. Both are disabled until you explicitly accept them in the consent banner, and nothing is sent until that point.

• Google Analytics 4 — page views, referral sources, country-level geography. IP addresses are anonymized by Google. Cookies prefixed _ga / _gid, retained for up to 14 months.
• Umami — privacy-respecting, aggregate analytics. Does not set cookies by default; uses a local storage entry to de-duplicate visits.

What we do not use

We do not set advertising cookies, remarketing pixels, cross-site trackers, session-replay recorders, or fingerprinting scripts. We do not sell or share visitor data with advertising networks. If you see a tracker in your browser devtools that is not listed on this page, please email privacy@posthawk.dev and we will investigate.

Turning cookies off

You have three options, in increasing order of thoroughness:

• Click "Reject" on the consent banner — analytics cookies will never be set. You can change your mind later by clearing site data in your browser, which will bring the banner back.
• Disable cookies in your browser settings — the dashboard will still work but you will be logged out on every tab close, since auth sessions depend on cookies.
• Use a blocker like uBlock Origin or Privacy Badger — the analytics scripts will not load at all.

Changes to this policy

If we add a new analytics tool, payment processor, or any third party that sets cookies, we will update this page and reset the consent banner so existing visitors are asked again. Material changes are announced at least seven days before they take effect.

Questions

If you have questions about our cookie use — including data access or deletion requests under UK GDPR — reach out at privacy@posthawk.dev.