Cookies

We keep this list accurate on purpose. If a cookie or tag is not here, we do not run it — and you can verify that in your browser's network panel or on the Transparency page.

Strictly necessary#

These make the app work and are always on.

• Authentication / session (Privy, Sanctum) — keep you signed in. No analytics use.
• pa_consent — remembers your cookie choice so we do not ask again. ~180 days.
• pa_geo — your region (EEA or not), used to decide the consent default. 24 hours.

Functional — attribution#

First-party, stored only by us, never shared with a third party except a consented ad-conversion upload (below).

• pa_attr — the first campaign/referrer that brought you (UTM, click id, affiliate code), so we can understand our channels. Up to 90 days. In the EEA/UK this is set only after you consent; outside the EEA it is set by default.
• pov_ref — the partner/affiliate code from a referral link, so the referrer is credited. 60 days.

Analytics and advertising — only with consent#

Loaded only after you accept the banner. In the EEA/UK the default is deny, so none of these exist until you choose. You can also disable them entirely on the Transparency page.

• Cookieless analytics — aggregate traffic, sets no cookies and stores no personal data.
• Google Analytics (_ga, _ga_*) — usage measurement.
• Google Ads (_gcl_*) — measures which ad led to a signup. Conversions are also reported server-side, only for users who consented.

What we never set#

No session-recording cookies, no behavioural-autocapture SDKs, no third-party tracking pixels that fire before consent, and nothing that sells or brokers your data.

See the Privacy doc for how this relates to your conversations, which are handled separately and far more strictly.