What we use
A cookie is a small file your browser stores so a site can remember things between page loads. We use three categories:
Strictly necessary
These can't be turned off. They keep you signed in, protect forms against CSRF attacks, and remember your cookie consent decision so we don't ask again.
__session— keeps you signed in. HttpOnly + Secure + SameSite=Lax.X-CSRF-Token(header, not a cookie) — double-submit token rotated per session.localStorage: kirality.cookie_consent.v1— your choices on this page.
Functional
Default OFF. UX preferences kept locally; nothing transmitted.
kirality.tutorial.dismissed.v1— hide the first-visit tutorial.- Sidebar-collapsed state, theme preference, panel widths.
Analytics — cookie-based, default OFF
These set cookies or browser storage, so they stay off until you turn them on:
- Google Analytics 4 (sets
_gacookies) — page views and aggregate usage trends. - PostHog (cookies +
localStorage) — product analytics: which features get used, and where people get stuck in a flow. Session replay is off.
URLs sent to either vendor are redacted before they leave your browser: password-reset tokens, invite tokens, OAuth codes and API keys are stripped from the address, so a link you clicked can never become a usable credential in someone else's analytics account.
Always-on measurement — no cookies
Three things run regardless of the toggle above, because they set no cookies, read no browser storage, and cannot follow you to another site:
- Vercel Web Analytics — anonymous page-view and visitor counts. We would otherwise be blind to whether our own pages work at all.
- Vercel Speed Insights — anonymous page-performance timings.
- Sentry — samples errors so we can fix crashes.
We do not run advertising trackers, and we never sell data.
Your choices
to change your mind. You can also clear this site's stored data in your browser's settings to reset everything.
Contact
Privacy questions: privacy@kirality.com.