Cookie Policy
What we store on your device and why.
Last updated:
1. Overview
Cookies and similar browser-storage mechanisms (localStorage, sessionStorage) let websites remember you between visits and measure how the site is used. grith.ai uses a small, defined set of them, listed below. For the full picture of how we handle personal data, see our Privacy Policy.
2. Categories we use
2.1 Strictly necessary
These are required for the site to function. They do not need your consent under UK GDPR / PECR.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
cookie_consent | grith.ai (localStorage) | Remembers your choice in the consent banner so we don't ask on every visit. | Until cleared |
__ph_opt_in_out_* | PostHog (localStorage) | Written only if you decline after analytics had been running in anonymous mode. It records the opt-out so capture stays off. | Until cleared |
better-auth.session_token (with a __Secure- prefix in production) | grith.ai (httpOnly cookie) | Authenticates you when signed in. Required for the dashboard, account, and billing pages. | Up to 7 days; refreshed or removed as your session changes |
2.2 Anonymous analytics (no storage)
Before you make a choice in the banner, we measure page views in a storage-free mode. In this mode PostHog is configured with in-memory persistence only: nothing is written to or read from your device - no cookie, no localStorage entry, no sessionStorage entry. The pseudonymous identifier exists only for the current page load and is discarded when you navigate away or close the tab, so you are not recognised on a later visit and no profile is built.
Because it involves no access to information stored on your device, this mode falls outside the consent requirement in PECR regulation 6. We rely on legitimate interests (understanding aggregate site usage) as the lawful basis under UK GDPR. If you decline, or your browser sends a GPC/Do Not Track signal, this mode does not run either.
2.3 Analytics cookies (consent-gated)
These only run if you accept non-essential cookies in the banner. They add persistence to the analytics described above, so we can tell a returning visitor from a new one, and see where people come from and which features are used. The events are associated with a pseudonymous random identifier; we do not link that identifier to your grith account.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
ph_* (cookie and localStorage entries; the exact suffix contains our PostHog project key) | PostHog | Pseudonymous visitor identifier, consented page-view analytics, and session correlation. We use PostHog's EU region. | Up to 12 months |
Until you accept, no PostHog cookie or localStorage entry is written at all. Declining stops analytics capture entirely, including the storage-free mode described above.
Analytics requests are sent to grith.ai/ingest and forwarded by our server to PostHog's EU region (eu.i.posthog.com). This keeps the requests first-party so they are not dropped by content blockers. Your session cookie is never forwarded to PostHog.
3. How to control cookies
- The banner appears on your first visit. Click "Accept" to enable analytics cookies or "Decline" to turn analytics off altogether. You can change your choice at any time using the "Cookie settings" button in the site footer.
- Your browser can block or delete cookies globally. Doing so will sign you out and disable any account features that depend on persistent state.
- Do Not Track / GPC. We respect Global Privacy Control and browser Do Not Track signals. If your browser sends either signal, we treat it as a declined-consent instruction, keep all analytics capture disabled (including the storage-free mode), and do not show the consent banner.
4. Updates
We'll update this page if we add or remove a cookie or change a provider. The "Last updated" date at the top reflects the current version.
5. Contact
Questions about cookies? Email privacy@grith.ai.