Cookie Policy · effective 7 September 2026, updated 7 September 2026
The cookies we set, and why.
1. The short version
Two cookies keep you signed in and keep sign-in secure. You cannot turn those off, because the product does not work without them. Everything else — analytics and ad measurement — is optional, off until you agree, and changeable at any time from Cookie settings in the footer.
2. Strictly necessary
- Sign-in: a first-party token that keeps you logged in and attaches your session to the right account. Cleared when you sign out.
- Security: first-party values that protect sign-in and payment flows from forged or replayed requests.
These are set because you asked for a service that needs them, so they do not require consent. We do not use them to profile you or share them with anyone.
3. Optional: analytics and ad measurement
These load only after you accept. Decline, and Google's tags run in a mode that stores nothing on your device and sends no identifiers, and PostHog does not start at all.
- Google Analytics (GA4) — which pages people arrive on, which they leave from, and which steps of signup they finish. Set by Google as a third party.
- Google Tag Manager — loads and manages the tags above. Set by Google as a third party.
- Google Ads conversion measurement — records that a signup or subscription followed a Google ad. These conversions are imported from Google Analytics, so they depend on your analytics choice. We do not run remarketing or personalised-advertising cookies, and we do not build advertising profiles.
- PostHog — product analytics and JavaScript error reports, so we can see which features are used and fix what breaks.
- Hotjar — heatmaps and anonymised session replays showing how pages are actually used, so we can see where a layout confuses people. Keystrokes in form fields are suppressed.
4. Your choice, and changing it
The banner appears before any optional cookie is set. Whatever you pick is stored on your device and honoured on every later visit. To change it, open Cookie settings in the footer — you can withdraw consent as easily as you gave it, and it takes effect immediately.
Clearing your browser storage clears the decision too, so the banner will ask again.
5. The mobile apps
The iOS and Android apps are not web pages and set no cookies. They do not use the advertising identifier and do not track you across other companies' apps or websites.
6. Contact
Questions about this policy, or about the data behind it, go to contact@colecta.ai. Our Privacy Policy covers everything beyond cookies.