Cookie Policy

1. What cookies are

Cookies are small text files stored in your browser when you visit a website. Some are required for the site to function (like staying logged in); others are optional and help us understand how the Service is used.

2. Cookies we use

Strictly necessary — no consent required

• `ts_cookie_consent` — stores whether you accepted or declined optional analytics, so TubeSignalHQ can remember and honor your privacy choice on this device. First-party. Stored in your browser's `localStorage` (not a cookie). Contains only the literal value `accepted` or `declined` — no tracking, activity, or analytics-event data. Persists until you change your choice or clear your browser's site data yourself; `localStorage` has no automatic expiry.
• A session authentication cookie set by Supabase Auth is required for you to stay logged in. First-party. This cookie is essential and cannot be disabled without breaking the Service.

Analytics and performance — optional, requires consent, and none of these are set, generated, or transmitted until you accept, or if your browser sends Do Not Track

• Internal product analytics identifier (`_ana_sid`) — a short-lived, randomly generated identifier stored in `sessionStorage` (not a cookie), used to correlate your in-product actions with our own internal product analytics, independent of Google Analytics or PostHog. First-party. Exists solely to measure feature usage — it plays no role in authentication, security, or fraud prevention. Persists only for the current browser tab's session; a new one is generated if you open a new tab or the tab is closed and reopened.
• `ts_utm` — a first-party browser cookie recording the campaign that first brought you to the site, so we can attribute signups correctly. Expires after 30 days.
• `ts_ref` — a first-party, server-set (`httpOnly`) cookie recording a partner referral code when you arrive via a partner link, so we can attribute the referral correctly. Expires after 60 days. Because it is `httpOnly`, it cannot be read by page scripts — only our server sets and reads it.
• Google Analytics 4 (cookies: `_ga`, `_gid`, `_ga_*`) — third-party. Measures page views, feature usage, and conversion events. Data is sent to Google servers in the United States under Google's Data Processing Amendment. Cookie durations are set by Google's own SDK, not directly configured by us — `_ga`/`_ga_*` are typically retained around 2 years and `_gid` around 24 hours per Google's published defaults, which Google may change; we report this accurately rather than asserting a fixed duration we don't control.
• PostHog (cookies/local-storage keys prefixed `ph_`) — third-party. Product analytics to understand feature usage patterns and user flows within the application. Session replay/recording is explicitly disabled in our PostHog configuration and is never active, regardless of consent. Duration is set by PostHog's own SDK defaults, not directly configured by us.

Do Not Track. When your browser sends a Do Not Track signal, none of the optional items above are set or transmitted — this consistently overrides even a previously accepted analytics choice, for every item in this section (Google Analytics 4, PostHog, our internal analytics identifier, and the `ts_utm`/`ts_ref` attribution cookies alike), not just some of them.

We do not use advertising cookies or cross-site behavioural tracking cookies, and we do not sell or share cookie data with third parties for marketing purposes.

3. Your choice, and how to change it

Use the settings above to accept or decline analytics cookies at any time — your choice takes effect immediately, mid-session, and is remembered on this device. You'll see the cookie banner again on a new browser/device until you make a choice there too.

What happens when you accept. Google Analytics 4, PostHog, our internal product analytics identifier, and `ts_utm`/`ts_ref` attribution all initialise from that point on, including if you accept partway through a session rather than on your first visit.

What happens when you decline, including mid-session. Google Analytics 4 and PostHog both stop sending further events immediately — Google Analytics 4 via Google's own Consent Mode, and PostHog by explicitly opting the browser out of capture, which also clears PostHog's own previously-stored identifiers on this device. Our internal analytics identifier stops being used and no further internal analytics events are sent. No new `ts_utm` or `ts_ref` cookie will be set going forward, and any existing `ts_utm` cookie is cleared immediately. `ts_ref` is set by our server in a way page scripts can't read or clear directly (see Section 2) — if one was already set before you declined, it may remain and could still be used to attribute a purchase completed before it expires (up to 60 days); declining prevents a new one from being set, but doesn't retroactively invalidate one already present.

Declining analytics cookies does not affect your ability to use TubeSignalHQ — every feature works the same either way.

4. Browser-level controls

Your browser also lets you block or delete cookies directly, independent of the setting above:

• Chrome: support.google.com/accounts/answer/32050
• Safari: support.apple.com/guide/safari/sfri11471/mac
• Firefox: support.mozilla.org — clear cookies and site data
• Edge: support.microsoft.com — delete cookies in Microsoft Edge

Blocking the strictly-necessary session cookie through your browser will prevent you from staying logged in.

5. Changes to this policy

We may update this policy from time to time. Material changes will be communicated via email or an in-app notice at least 14 days before they take effect.

6. Contact

Questions about cookies or this policy: support@tubesignalhq.com. For the full picture of what data we collect and why, see our Privacy Policy.