Last updated: 7 June 2026
We split everything that could be considered a cookie or tracker into four categories. Only the first is on by default; the other three are opt-in. Update your preferences below at any time — changes apply immediately.
Necessary
Authentication (Supabase session), CSRF, language preference, the cookie that records your consent itself. Without these the site can't work; they are not configurable.
Analytics
Aggregate product usage — which pages get viewed, which buttons get clicked. Today this is PostHog (EU-hosted) and, where enabled, Google Analytics 4; we plan to migrate to a self-hosted Umami instance during the Phase 5L OSS swap. GA4 is configured with IP anonymisation, and no personally identifying information is captured.
Performance (RUM)
Real-user-monitoring — page-load timings, JavaScript errors. Today this is Sentry (EU-hosted). Unhandled errors are always captured for forensic safety (no PII), but heavyweight RUM features — trace sampling + session replay — stay off until you opt in here.
Marketing
Attribution + retargeting (TikTok pixel, Meta pixel, etc.) for paid acquisition campaigns. Off until we run any paid campaigns, and only activates if you opt in. Never used to share data with third-party data brokers.
Your preferences
How we never track you
We do not embed advertising or social pixels, and we do not use third-party data brokers on the public site. We do not fingerprint your device. We never share cookies with third-party advertising networks. Aggregate licensed data goes to buyers under our Data Buyer Licence; never your personal data.