Cookie Policy

1. What cookies are

Cookies are small files stored on your device; similar technologies include local storage and session storage. We use them to keep you signed in, remember preferences and measure how the service is used.

2. Cookies we use

• reviews-auth (and related): strictly necessary — keeps you signed in and secures your session. Duration: session to 30 days.
• NEXT_LOCALE: functional — remembers your language. Duration: browser session.
• nk_anon: first-party analytics — an anonymous identifier used to measure activation and usage. Duration: 1 year.
• nk_utm: first-party analytics — first-touch campaign attribution. Duration: 1 year.
• nk_session: first-party analytics — groups events within a visit. Stored as a cookie (30 minutes) and in session storage (until the browser tab closes).
• PostHog (ph_<project>_posthog cookie and local/session storage entries with the same prefix): optional product analytics and masked session replay. Set only after you accept analytics; rejecting or withdrawing consent stops PostHog and clears them. Duration: cookie 1 year; storage until cleared.
• __ph_opt_in_out_<project> (local storage): set by PostHog when you accept analytics, to record that PostHog may run. Cleared when you reject or withdraw consent. Duration: until cleared.
• nk_posthog_consent and nk_consent (local storage): strictly necessary — record your cookie choice, the date and the policy version, so we can respect and prove it. Kept until you change your choice or clear your browser storage.
• nk_first_touch_utm, nk_route_events and nk_human_view_fired (session storage): first-party analytics — first-visit campaign, avoiding duplicate page events, and noting that a report was read. Set only after you accept analytics. Duration: the browser tab session.

3. Your choices

Strictly necessary cookies are always set because the service cannot work without them. The first-party analytics cookies nk_anon and nk_session contain only random identifiers, and nk_utm contains the campaign tags (such as utm_source) of the link that first brought you to us. They are not used for advertising and can be accepted, rejected or changed through the cookie banner and Cookie settings; they can also be disabled through your browser settings. Blocking some cookies may affect how the service works. Optional analytics and session replay (PostHog) do not load until you accept; if you reject, PostHog does not run at all, with or without cookies. We do not use third-party advertising or tracking pixels.

Personalized audit or report URLs contain a pseudonymous recipient identifier. Requesting one creates a server-side record that the report was served and attributes campaign response; this basic server record does not require cookies, local or session storage, an open pixel or a third-party click tracker. Any separate browser analytics or session replay remains off by default and starts only after you consent.

4. Third parties and Do Not Track

We do not use third-party advertising or tracking pixels. Where a third party sets cookies, that third party's own cookie and privacy notices also apply. We currently do not respond to browser "Do Not Track" signals in a standardized way; we minimize tracking by default.

5. Changes

We may update this Cookie Policy as our use of cookies changes; the "Last updated" date will be revised.