Legal
Cookie Policy
Effective date:
What cookies we use
We keep it minimal. Three categories:
Necessary (always on, no opt-out). These make the site work: authentication session cookies, checkout and fraud-prevention cookies set by our payment processor, security cookies, your cookie-consent choice itself (opt_cookie_prefs), and the team access cookie used during maintenance mode. Disabling these breaks login and checkout, so they cannot be turned off.
Analytics (your choice). Optional product analytics help us understand what content helps students. On this site that means PostHog. PostHog does not collect until both are true: (1) you opt in via Cookie preferences, and (2) our production capture setting is on. Accepting analytics while production capture is off records your choice but does not send PostHog events. Preview deployments with a configured key may collect after consent without that production capture setting. Separately, Vercel Analytics runs as a privacy-friendly, first-party aggregate layer (no advertising profile, no marketing pixels). It is not part of the optional PostHog toggle and is not gated by the analytics switch.
Marketing (none today). We do not run advertising or retargeting pixels. The preferences panel notes that marketing pixels are not in use; the category stays off and cannot be turned on until pixels ship. Before any marketing pixel ships, this policy will be updated first, a Marketing control will become optional (default off), and a "Your Privacy Choices" link will remain in the footer.
Cookie table
| Name / provider | Category | Purpose | Duration |
|---|---|---|---|
| Supabase Auth session cookies | Necessary | Keep you signed in across / and /journal | Session / rotating |
| Stripe Checkout cookies | Necessary | Hosted checkout + fraud prevention | Per Stripe session |
opt_cookie_prefs | Necessary | Stores your analytics/marketing choices | Up to 400 days |
| Maintenance / gate cookie | Necessary | Team access during maintenance mode | Short-lived |
| Vercel Analytics | Privacy-friendly site metrics (not the optional toggle) | Aggregate traffic (no ad profile) | Per Vercel docs |
PostHog (ph_* when enabled) | Analytics (optional) | Product usage only after consent, and on production only when capture is on | Per PostHog config |
Your choices
A consent banner appears on your first visit. Optional PostHog does not collect until you save analytics on (and, on production, until our capture setting is on). Choosing Necessary only or turning analytics off keeps PostHog from collecting. You can change your mind at any time via the Cookie preferences control in the footer (or reopen it from this page). When your browser sends a Global Privacy Control (GPC) signal (Sec-GPC: 1 or navigator.globalPrivacyControl), we treat optional analytics and marketing as off by default until you explicitly choose otherwise. Your browser can also block or delete cookies entirely; the site will work, but you may need to sign in more often.
More information
How we handle personal data generally: Privacy Policy.
Questions: support@onepurposetrading.com · One Purpose Trading, LLC