What we use
A cookie is a small file your browser stores so a site can remember things between page loads. We use three categories:
Strictly necessary
These can't be turned off. They keep you signed in, protect forms against CSRF attacks, and remember your cookie consent decision so we don't ask again.
kirality_session— auth session ID. HttpOnly + Secure + SameSite=Lax.X-CSRF-Token(header, not a cookie) — double-submit token rotated per session.localStorage: kirality.cookie_consent.v1— your choices on this page.
Functional
Default OFF. UX preferences kept locally; nothing transmitted.
kirality.tutorial.dismissed.v1— hide the first-visit tutorial.- Sidebar-collapsed state, theme preference, panel widths.
Analytics — cookie-based, default OFF
These set cookies or browser storage, so they stay off until you turn them on:
- Google Analytics 4 (sets
_gacookies) — page views and aggregate usage trends. - PostHog (cookies +
localStorage) — product analytics: which features get used, and where people get stuck in a flow. Session replay is off.
URLs sent to either vendor are redacted before they leave your browser: password-reset tokens, invite tokens, OAuth codes and API keys are stripped from the address, so a link you clicked can never become a usable credential in someone else's analytics account.
Always-on measurement — no cookies
Two things run regardless of the toggle above, because they set no cookies, read no browser storage, and cannot follow you to another site:
- Vercel Web Analytics — anonymous page-view and visitor counts. We would otherwise be blind to whether our own pages work at all.
- Vercel Speed Insights — anonymous page-performance timings.
- Sentry — samples errors so we can fix crashes.
We do not run advertising trackers, and we never sell data.
Your choices
to change your mind. You can also clear all kirality.* keys from your browser's Application → Local Storage panel to reset everything.
Contact
Privacy questions: privacy@kirality.com.