Cookie Policy

1. What we set

Cookies on hostingprof.com fall into three categories: strictly necessary, functional, and analytics. Each is described in the sections that follow. The cookie consent UI in the footer lets you accept or reject analytics cookies independently.

2. Strictly necessary

These cookies are required for the site to function. They cannot be disabled because disabling them would break login, session continuity, or rate-limit safety.

• Supabase Auth session — a short-lived JWT cookie that keeps you logged in. Set only after you complete a magic-link login. Lifetime: 1 hour, refreshed automatically while you browse.
• Supabase Auth refresh token — a long-lived cookie that lets the session JWT renew without re-login. Lifetime: 30 days. Cleared on logout.

3. Functional

These cookies remember preferences that improve the experience but are not required for the site to work.

• Cookie consent state — a first-party cookie that stores your choice from the consent banner so we do not ask again on every page load. Lifetime: 12 months. Cleared if you re-open the consent UI.

4. Analytics (PostHog — consent-gated)

PostHog Cloud powers product analytics: which pages are read, which tools complete, which CTAs convert. It sets a first-party cookie with a pseudo-random visitor identifier. PostHog is loaded ONLY after you click "Accept analytics" in the cookie consent banner if you are visiting from the EU, EEA, UK, Switzerland, Norway, or Iceland (detected at the edge from your country header — we do not store the IP). Outside those regions PostHog loads by default and you can opt out at any time via the same banner.

5. Vercel Analytics (always-on, GDPR-safe)

Vercel Analytics counts page views and Core Web Vitals at the edge without setting any cookies and without per-visitor identifiers. It is GDPR-safe per Vercel's public documentation and runs for every visitor regardless of consent state. The data is aggregate-only — we cannot use it to identify individual visitors.

6. How to opt out

Visit our cookie consent banner in the footer to opt out — coming Phase 6. Until the banner ships, you can opt out of PostHog by setting your browser's Do Not Track flag (we honor it) or by adding posthog.opt_out_capturing()via the browser console. You can also block PostHog at the network layer via your browser's tracking-protection settings or a privacy-focused extension.

Strictly-necessary cookies cannot be disabled — disabling them would break login. You can still browse and run the public tools without a logged-in session.

Questions about cookies? Email privacy@hostingprof.com. See also the Privacy Policy for the full processor list.