Cookie Policy
Last updated: September 11, 2026
Overview
We use essential storage to keep you signed in and remember your cookie choice, and Google Analytics 4 and PostHog to measure website use.
Consent
We count page views and cookie-banner choices without analytics cookies, before you choose and after you decline. This limited measurement does not attach your account ID. PostHog uses a temporary server-generated identifier; Google Analytics sends cookieless measurement signals. Both services receive network information when your browser contacts them. Accept enables analytics cookies and links subsequent activity to your account when you sign in, using an internal ID, never your email. Decline keeps analytics cookies and account-linked tracking off.
Your current choice: not made yet. — the bar shows again and analytics cookies stay off until you accept. Cookieless page measurement continues.
Cookies we set
Essential (no opt-out)
Set only once you sign in. vexa-token and vexa-user-info hold your API token and basic account details (id, email, name) so the dashboard can authenticate you; both are HTTP-only and expire after 30 days. Our authentication library additionally sets session, CSRF and callback cookies for the duration of your session. Blocking these will stop you from signing in.
Analytics (opt-in where required)
Google Analytics (GA4), PostHog.
Examples
Google Analytics
_ga, _ga_*, _gid, _gat (lifetimes per Google).
PostHog
ph_*_posthog (one cookie, lifetime per PostHog); for signed-in users it carries an internal account ID, never your email.
Third-party recipients
Google and PostHog receive the analytics data described above. Our marketing pages also load placeholder avatar images from i.pravatar.cc, which receives your IP address and user agent as part of that request. The full list of recipients is at /legal/subprocessors.