Cookies, briefly.

1. What runs by default

By default, Eavesdrop sets only strictly necessary cookies. Plausible is cookieless and loads for everyone to count page views. PostHog loads only after you accept analytics on the cookie banner. We do not pre-tick the analytics box.

2. Strictly necessary

These keep the site working. Under regulation 6(4) of the Privacy and Electronic Communications Regulations 2003 we are not required to ask consent for them, because without them you could not sign in or submit a checkout safely.

• sb-access-token / sb-refresh-token — HTTP-only, signed cookies set by Supabase Auth that prove to our server you are signed in. Lifetime: rolling, up to thirty days, refreshed on use. First-party.
• __Host-csrf — a short-lived random value used to defend Server Actions and form posts against cross-site request forgery. Lifetime: per session.
• ev-cookie-choice — a tiny first-party value (no personal data) that records whether you have answered the cookie banner, so we don’t show it again on every page load. Lifetime: 12 months.

3. Analytics

Plausible loads for everyone without cookies. PostHog browser analytics loads only after you accept the analytics option on the cookie banner. We also record a server-side purchase event without cookies for order analytics.

• ph_* (PostHog) — product analytics on signed-in flows so we can tell whether the order pipeline is working. PostHog uses a small set of first-party cookies prefixed ph_ to identify a returning session and store consent state. We do not configure it for cross-site tracking. Purpose: understand which flows succeed and which fail. Lifetime: 12 months. EU-region.
• Plausible — aggregate page-view counts. No cookies set, no cross-site identifiers. Plausible records the page you visited, a hashed visitor key that rotates daily, and the referrer. We list it here for transparency even though it does not store anything in your browser. Purpose: traffic counts on the marketing pages. EU-hosted.

4. Marketing

None. Eavesdrop does not run advertising cookies, remarketing pixels, third-party social trackers or ad-network identifiers. We do not sell, rent or share your browsing behaviour with anyone for advertising purposes. If that ever changes we will update this page, give you a fresh consent prompt, and email account holders before any new tracker fires.

5. Change your mind

Whatever you chose at the cookie banner, you can change it later. The footer on every page carries a “Cookie choices”link that re-opens the banner and lets you switch between “Essential only” and “Accept analytics”. Switching to essential-only also clears any PostHog cookie that was previously set. You can also clear cookies entirely via your browser’s privacy controls; the next time you visit, the banner will reappear.

For the broader picture of how we use the data behind these cookies, read the privacy notice. For complaints about cookie practice, the regulator is the Information Commissioner’s Office at ico.org.uk/make-a-complaint. Cookie questions to hi@geteavesdrop.com.