Cookie Policy
Last updated: 20 September 2026
What cookies are
Cookies and similar technologies (local storage, pixels) are small pieces of data stored in your browser. We use them to keep you logged in, keep the Service secure, and understand how the product is used.
By default, our analytics do not use any of them. Unless you allow cookies on the banner, we measure visits cookieless — no analytics cookie or identifier is written to or read from your device. How that works is explained below.
Cookies we use
| Category | Purpose | Set by | Consent needed? |
|---|---|---|---|
| Strictly necessary | Keep you signed in; maintain your session and security | startposting / Supabase (auth) | No — required to run the Service |
| Security | Detect bots and abuse on sign-up and login | hCaptcha | No — security |
| Payments | Process checkout securely | Freemius | No — required for purchases you initiate |
| Analytics — cookieless (default) | Count visits and page views without identifying you | PostHog | No — nothing is stored on your device |
| Analytics — cookie-based (optional) | Recognise a returning browser across visits, for a fuller picture of the funnel | PostHog | Yes — only if you accept the banner |
| Analytics — cookieless (always) | Count visits, page views and traffic sources | Ahrefs | No — no cookie, nothing stored on your device |
How cookieless analytics works
If you have not accepted the banner, PostHog counts your visit without storing anything on your device. Instead of a cookie, our analytics provider derives a temporary identifier on its servers by hashing your IP address, your browser's user-agent string and a secret value that changes every 24 hours. The old secret is discarded, so the identifier cannot be linked back to you or joined up across days.
In practice this means:
- we can see that a page was visited, from where and in what order;
- we cannot recognise you tomorrow, build a profile, or track you to any other website;
- no analytics cookie or device identifier is created.
Our lawful basis for this is our legitimate interest in knowing whether our own site works (GDPR Art. 6(1)(f)). You can object to it at any time — see below.
Ahrefs works the same way, and stays cookieless whatever you choose. It counts the page view, the site that referred you and your browser and device type. It sets no cookie and reads nothing from your device, and it uses your IP address to derive your country and city and then, per Ahrefs' documentation, discards the raw IP without storing it. It is the one measurement that does not change when you accept the banner. If your browser sends "Do Not Track" or Global Privacy Control, it is not loaded at all.
Managing your choices
To allow cookie-based analytics: press "Allow cookies" on the banner. This gives us a fuller picture (returning visits, approximate country) and is entirely optional.
To decline: press "No thanks", or simply ignore the banner. Either way no analytics cookies are set and you stay on cookieless measurement. If you press "No thanks" we store one small entry in your browser recording that refusal, so we don't ask again — that entry holds your answer and nothing else.
To object to cookieless measurement as well: email privacy@startposting.app and we will exclude you, or enable "Do Not Track" / "Global Privacy Control" in your browser, which we respect. Browser-level tracker blocking also prevents it.
You can change a previous choice at any time by clearing this site's cookies and site data in your browser, which will make the banner appear again on your next visit.
You can also block or delete cookies in your browser settings, though strictly-necessary cookies are needed for the Service to work.
Changes
We'll update this policy as our tools change and revise the date above.