Cookie Policy

1. What cookies are

A cookie is a small text file a website stores in your browser to remember things across page loads - for example, that you’re signed in. This policy covers cookies and similar browser storage (localStorage, sessionStorage) set by appeak.pro and by the small number of services we use to run the product.

2. The cookies we set

Everything we set on appeak.pro falls into one of two categories:

Strictly necessary - authentication

• Supabase auth cookies (e.g. sb-<project>-auth-token). HTTP-only, secure, SameSite=Lax. Used to keep you signed in across page loads and to refresh your session safely. Lifetime: about 7 days, renewed automatically while you’re active. Cleared when you sign out.

These cookies are required for the app to work. Disabling them will prevent you from signing in.

Product analytics

• PostHog. We use PostHog in cookieless mode(persistence: "memory") for general page-view and event analytics, so no PostHog identifier survives a browser refresh.Session replay is enabled and may use a short-lived session identifier in browser storage (cleared when the tab is closed) so we can stitch the events of a single visit together. We use this only to understand product usage and reproduce bugs.

Advertising measurement

On appeak.pro (not on customer hub subdomains, and not on our admin pages) we load advertising tags so we can tell whether our own ads led to a visit, an account, or a completed free audit. Google Ads counts the completed audit once and does not build remarketing audiences (ad personalization signals stay off). Reddit and Meta pixels count page views on public pages, a completed signup, and a completed free audit. Those platforms may use the events to measure and optimize our ads. None of these tags receives your email or the text of the audit.

• Google click cookies (_gcl_aw, _gcl_au, and sometimes _gcl_gs). Set by Google on appeak.pro when the tag loads, including when the address carries a gclid from an ad click. Google uses them to attribute the conversion. The click cookie typically lasts 90 days.
• appeak_gads. First-party, readable by the page, SameSite=Lax. Set for up to 24 hours when a free audit is first recorded, with that audit’s id as the value. The results page reads it, sends one conversion, and deletes it. A reload has nothing left to send.
• localStorage key gads_audit_<audit id>. Set to 1 in this browser after the conversion is sent, or when a privacy signal blocks it, so the same browser does not send it again.
• Reddit pixel (a2_…). Loaded on public marketing and audit pages. Reddit may set _rdt_uuid so a later visit can be tied to an ad click. We send PageVisit, SignUp, and Lead (a finished free audit).
• Meta pixel (Facebook and Instagram). Loaded on the same public pages. Meta may set _fbp and, after an ad click,_fbc. We send PageView, CompleteRegistration, and Lead. Meta’s automatic button tracking stays off.
• appeak_px_signup and appeak_px_audit. First-party, readable by the page, SameSite=Lax. Set for up to 24 hours when that signup or audit is first recorded, holding the account or audit id. The next page sends one conversion to Reddit and Meta and deletes the cookie.
• localStorage keys px_reddit_signup_<user id>,px_meta_signup_<user id>, px_reddit_audit_<audit id>, and px_meta_audit_<audit id>. Set to 1 after that conversion is sent, or when a privacy signal blocks it, so the same browser does not send it again.

3. Cookies we do NOT use

• No TikTok pixel, and no other advertising pixels beyond Google, Reddit, and Meta.
• No fingerprinting libraries.
• No data selling, ever.

4. Cookies set on other domains

When you click out to one of our service providers, cookies they set live on their own domain (not on appeak.pro). The relevant ones:

• Lemon Squeezy checkout (appeakpro.lemonsqueezy.com). Lemon Squeezy is our Merchant of Record. When you’re on their hosted checkout, they set cookies on their own domain to handle your purchase, fraud prevention, and tax compliance. We do not see or control those cookies. See Lemon Squeezy’s privacy policy.
• Supabase auth APIs (*.supabase.co). Email confirmation links pass through Supabase. Their session is request-scoped and not persisted as a cookie on your browser.
• Vercel (our hosting provider). On preview/non-production URLs, Vercel may set protection or analytics cookies; on appeak.pro production deployments these are disabled.

5. Your choices

Block or delete cookies in your browser. Every modern browser lets you manage cookies per site (Settings → Privacy or Security). If you block our auth cookies, you won’t be able to sign in.

Opt out of analytics and ad measurement. Setting your browser’s “Do Not Track” (DNT) or “Global Privacy Control” (GPC) signal is respected by PostHog - we will not capture analytics events when either is set. The same signals skip the Google Ads tag and the Reddit and Meta pixels: they are not loaded, and a signup or completed audit does not send a conversion. You can also block these services at the network level via your browser’s tracking protection.

6. Changes to this policy

If we add new cookies or change how the existing ones are used in a material way, we will update this page and the effective date at the top. For non-material changes (clarifications, formatting), we’ll just edit in place.

7. Questions

Reach us via the contact form. The full picture of how we handle data lives in the Privacy Policy.