Legal
Cookie Policy
Every cookie we set, what it does, and how long it lasts. Essential plus one anonymised analytics cookie, and nothing else.
Draft pending legal review. This document is written to be honest and readable, but it has not yet been reviewed by a lawyer. Questions in the meantime go to support@stacked.app.
Last updated
Short version: we set the cookies needed to keep you signed in, plus one analytics cookie with your IP anonymised. There are no marketing cookies, no advertising pixels and no cross-site trackers. That is why the banner has one button instead of a settings maze.
Essential cookies
These make the service work. They cannot be turned off without breaking sign-in, and they do not require consent under UK and EU rules.
| Cookie | Purpose | Duration |
|---|---|---|
sb-access-token | Keeps you signed in | 1 hour, refreshed |
sb-refresh-token | Renews your session without another magic link | 30 days |
stacked-workspace | Remembers which workspace you were last in | 1 year |
__Host-csrf | Cross-site request forgery protection on form posts | Session |
Analytics
One first-party cookie, from PostHog running on their EU instance, with IP anonymisation on and session recording off.
| Cookie | Purpose | Duration |
|---|---|---|
ph_* | Counts page views and feature usage so we can tell which tools are actually used | 12 months |
What it is used for: knowing that 40% of people who open the Clipper never render a clip, so we can find out why. What it is never used for: building a profile of you, or telling anyone else anything about you.
To decline it: use the "Decline analytics" link on the banner, or send a Global Privacy Control or Do Not Track signal — we honour both. Declining sets a single preference cookie and nothing else changes about the product.
Local storage
Not cookies, but you should know about them. All of these live only in your own browser and are never sent to us.
| Key | Purpose |
|---|---|
stacked-theme | Your light, dark or system choice |
stacked-cookie-choice | So the banner stops appearing |
stacked-draft-* | Autosaved text while you are editing, so a closed tab never loses work |
What we do not use
- Advertising or retargeting pixels of any kind, including Meta, Google Ads, TikTok, LinkedIn and X.
- Third-party cookies. Everything above is first-party.
- Fingerprinting, canvas or otherwise.
- Session recording or heatmapping tools.
- Cookies that follow you to other sites. There is nowhere for them to follow you to.
Third-party pages
Some parts of the flow happen on someone else's domain: Stripe Checkout when you pay, the OAuth screen when you connect a platform, our status page. Those pages set their own cookies under their own policies. We do not control them, and we do not receive anything from them.
Changing your mind
- Analytics: the "Decline analytics" link on the banner, or email us.
- Everything: clear cookies for this site in your browser. You will be signed out and the banner will reappear.
- Blocking essential cookies entirely will stop sign-in from working. There is no way around that, because the session has to live somewhere.
Changes
If we ever add a cookie category, this page changes first and the banner asks again. Given how the product makes money — subscriptions — we do not expect to.