“Cookies” here means anything stored on your device: cookies, localStorage, and sessionStorage. Strictly necessary and functional items run without consent (the platform can’t work without them). Analytics items run only if you opt in via our banner — nothing in that category loads before your choice, and we honor the Global Privacy Control signal as a rejection.
Change your choice anytime: .
| Name | Provider | Type | Category | Purpose | Duration |
|---|---|---|---|---|---|
| sb-*-auth-token (and related sb-* entries) | Supabase (first-party) | Cookie | Strictly necessary | Keeps you signed in securely | Session / until logout |
| Admin verification cookie | HEATCOACH (first-party) | Cookie | Strictly necessary | Extra security step-up for administrator actions | Short-lived |
| hc_consent | HEATCOACH (first-party) | Cookie + localStorage | Strictly necessary | Remembers your cookie choice so we don’t re-ask | 12 months |
| Unit preference, install-prompt and UI state | HEATCOACH (first-party) | localStorage | Functional | Remembers settings you chose (e.g. kg vs lbs) | Until cleared |
| ph_*_posthog (+ ph_* localStorage) | PostHog (US-hosted; EU–U.S. DPF + SCCs) | Cookie + localStorage | Analytics (opt-in) | Product analytics and masked session replay: anonymous device/session identifiers | Up to 12 months |
| sentryReplaySession | Sentry | sessionStorage | Analytics (opt-in) | Links masked error-replay segments within one browsing session | Browser session |
| Vercel Analytics / Speed Insights | Vercel | No cookies (cookieless) | Functional | Aggregated, anonymous traffic and performance metrics — no cross-site tracking | n/a (no device storage) |
| __stripe_mid / __stripe_sid | Stripe (on Stripe’s checkout pages only) | Cookie | Strictly necessary | Fraud prevention during payment — set on checkout.stripe.com, not on heatcoach.co | Per Stripe policy |
Questions? Email [email protected].