Cookie Policy
Last updated: 14 August 2026
🍪 Short version: StoatBoard uses strictly necessary cookies for authentication and security. Optional PostHog analytics, hosted in Germany, starts only after you select “Accept analytics”. Rejecting it leaves PostHog uninitialized. No advertising cookies, data brokers, or marketing pixels.
1. What Are Cookies?
Cookies are small text files placed on your device by a website when you visit it. They are widely used to make websites work correctly or more efficiently, and to provide information to the website operator.
2. Cookies We Use
Strictly Necessary Cookies
These cookies are essential for the site to function. They cannot be disabled without breaking the service and do not require your consent under French CNIL guidelines (Article 82 of the French Data Protection Act).
| Name | Provider | Purpose | Expiry |
|---|---|---|---|
| next-auth.session-token / __Secure-next-auth.session-token | StoatBoard | Maintains your authenticated session after login (NextAuth session cookie). | 30 days (or on logout) |
| __cf_bm | Cloudflare | Bot management — distinguishes legitimate users from automated traffic. Set by Cloudflare on our domain. | 30 minutes |
| _interaction / _interaction_resume | StoatBoard | Preserves the opaque Continue with StoatBoard authorization interaction while you sign in, link Stoat, and approve or refuse permissions. It does not contain a third-party return URL. | Up to 10 minutes |
| _session | StoatBoard | Maintains the first-party OpenID Connect provider session and supports secure single sign-on and logout. | Up to 14 days or on logout |
| cf_clearance | Cloudflare | Records that you have passed a Cloudflare security challenge (if triggered). Prevents repeated challenges within a session. | Session / 1 year |
| stoatboard:analytics-consent (localStorage) | StoatBoard | Remembers your analytics choice, the policy version, and when the choice was made. It contains no analytics identifier and prevents repeated prompts. | Until cleared or the consent version changes |
Cookie names starting with cf_ or __cf are set by Cloudflare as part of its CDN and security infrastructure. We do not control these cookies directly.
3. Analytics
For usage analytics, StoatBoard uses PostHog, hosted on servers in Frankfurt, Germany (EU). We do not initialize PostHog, identify a user, capture events, or start session replay before you explicitly accept analytics. After acceptance, PostHog stores analytics data using a combination of localStorage and a first-party cookie (ph_*) to maintain session continuity across page loads. For authenticated users, analytics is associated only with the internal account ID—not the account name or email address. Data is configured to stay in EU hosting. Analytics is never initialized on Continue with StoatBoard consent pages.
| Name | Provider | Purpose | Expiry |
|---|---|---|---|
| ph_* | PostHog (EU) | Optional analytics/session identifier used to group consented events and session replay context. For signed-in users, events may be linked to the internal account ID. | 1 year |
When accepted, PostHog uses autocapture and session recording. All replay text and input values are masked, marked private elements are blocked, request headers and bodies are not recorded, and sensitive URL routes lose their query string and fragment. Other URLs retain only allowlisted campaign parameters. Search analytics records only a length range and result count, never the search text.
4. What We Do NOT Use
- Additional analytics platforms — we do not use Google Analytics, Hotjar, or Microsoft Clarity alongside the optional PostHog integration described above.
- Advertising cookies — we do not use any ad networks or retargeting pixels.
- Social media tracking pixels — no Facebook Pixel, TikTok Pixel, etc.
- Data broker sharing — we do not sell or share your browsing data with data brokers or advertisers.
5. Managing Cookies
Use Cookie preferences in the footer to accept, reject, or later withdraw consent. Accept and reject are presented as equal choices. Withdrawing consent stops future PostHog capture, stops replay, and clears the associated local analytics identity. It does not affect essential storage.
You can also delete cookies and localStorage through your browser settings. Disabling essential session cookies will prevent you from staying logged in.
Instructions for common browsers:
6. Changes to This Policy
If we materially change optional analytics or its purposes, we will update this policy and increment the stored consent version. An outdated choice becomes invalid and the site asks for a new decision before initializing analytics again.
7. Contact
For questions about our use of cookies, contact: [email protected]
Related legal documents: Privacy Policy · Terms of Service · Content Policy · DMCA / Takedown · Legal Notice.