Cookie Policy
Last updated · 23 September 2026
Plain-English summary
klieg uses a small number of cookies. The essential ones (signing you in, remembering your consent choice) are always on. The non-essential ones (anonymous product analytics) only run if you tap Accept analyticson the banner at the bottom of the page. You can change your mind at any time — tap Cookie settings in the page footer.
1. What a cookie is
A cookie is a small file a website asks your browser to store. Some cookies expire when you close your tab; others persist for days, months, or years. We also use localStorage (a related browser API) for similar purposes — “cookie” in this policy covers both unless we say otherwise.
2. Essential cookies (always set)
These cookies are required for the service to function. You can’t turn them off without breaking sign-in, and we don’t set them for advertising or analytics purposes.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
| sb-access-token, sb-refresh-token | klieg (via Supabase Auth) | Keeps you signed in. Refresh-token is used to issue new access tokens silently. | Up to 30 days (refresh); ~1 hour (access) |
| klieg.installPromptDismissedAt | klieg (localStorage) | Remembers if you dismissed the “Install klieg” PWA prompt. | Persistent until cleared |
| klieg.cookieConsent (localStorage) + klieg_analytics_consent (cookie) | klieg | Stores your choice from the cookie banner, so we don’t ask again and so our servers honour it too. | 12 months |
| klieg_acq | klieg | Remembers where you first arrived from (a link, a campaign tag, a referring site) so we can tell which channels bring people to klieg. Not shared, and not used for advertising. | 30 days |
| klieg_ref | klieg | Set only if you arrive on an invite link, so we can connect you to the person who invited you when you create your account. | 30 days |
| klieg_demo | klieg | Set only if you try the logged-out demo and choose to keep those picks, so they become your first session when you sign up. | 1 day |
| theme | klieg (localStorage) | Remembers whether you chose the light or dark theme. | Persistent until cleared |
3. Analytics cookies (consent required)
These cookies only run if you tap Accept analytics on the cookie banner. They give us anonymous, aggregated insight into how the product is used — which features get tapped, where the funnel breaks, when a deploy looks like it broke something. We do not use them for behavioural advertising. We do not share the data with third parties for advertising.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
| ph_* | PostHog (EU Cloud) | Product analytics: pages you visit inside klieg and which controls you tap. Continuous session recording is off. The text on the page is masked before anything is sent, and we strip your recommendation wording out of the address bar. We never see your browsing elsewhere. | Up to 12 months |
| Sentry session replay (errored sessions only) | Sentry (EU region) | If a page errors, Sentry keeps a replay of the moments leading up to it so we can reproduce the fault. All text, all form inputs and all media are masked. Sessions that do not error are never recorded. | Up to 90 days |
To withdraw consent later, tap Cookie settings in the footer of any page and choose Reject analytics.
4. Third-party cookies on linked surfaces
When you make a payment, you’re sent to Stripe’s hosted Checkout. Stripe sets its own cookies on that page for fraud prevention and session handling. Those cookies are governed by Stripe’s own policies — see stripe.com/cookie-settings.
Similarly, the Stripe Customer Portal (where you cancel or update payment method) sets Stripe cookies on its hosted domain. These appear only while you use that flow.
5. Error monitoring
We use Sentry (EU region) to catch errors. Sentry’s standard error capture does NOT set ordinary tracking cookies in your browser — it gathers stack traces from the running page. It does record a masked replay of the moments before an error, but only on a session that actually errors: all text, inputs and media are masked out, and a session that never errors is never recorded.
6. Do Not Track
There’s no industry-wide standard for handling browser-level Do Not Track signals. We don’t currently honour DNT as a substitute for consent — the banner is the source of truth. We may revisit this if the UK adopts GPC (Global Privacy Control) as an enforceable signal.
7. Managing your choice
- Banner: appears the first time you visit. Pick “Accept analytics” or “Reject”.
- Change later: tap Cookie settings in the footer of any page.
- Browser controls: all modern browsers let you block or delete cookies via Settings. Blocking essential cookies will stop you signing in.
8. Updates
This policy will change if we add or remove tools that set cookies. We’ll update the “Last updated” date at the top of the page, and we’ll re-prompt for consent if we introduce a new non-essential category.
9. Contact
Questions: privacy@klieg.app
Post: Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom
See also our Privacy Policy and Terms of Service.