One cookie, and a few things in local storage.

PostHog analytics. One cookie, named ph_<project>_posthog, which holds a random id for your browser and the current session. It lets us tell a returning visitor from a new one, and lets a session replay be watched as one session rather than a scattering of clicks. It lasts about a year and is set on our own domain, because analytics is proxied through /ingest here rather than called at PostHog directly.

We look at this to find what is broken and what is confusing. It is not used for advertising, it does not follow you to other sites, and it is never sold. What a replay captures is described in the privacy page.

Our second analytics tool, Vercel Web Analytics, counts page views without a cookie of any kind, so it does not appear in this list.

Most of what pagehaul remembers is not a cookie at all. It sits in local storage on your own device, is never sent to us, and is not readable by any other site:

• Your theme, so the site opens the way you left it.
• Your unlock token, if you bought a plan. This is the plan itself: clearing it signs this browser out, which is why the unlock link is also in your email.
• How many free deep scans you have used, and how many scans are left in a pack.
• The addresses you scanned recently, so the list is one click away.
• A flag or two recording that a one-time email has already been sent, so it is not sent twice.

Clearing your browser data removes all of it, the plan included. Take the unlock link from your receipt email to bring it back.

Paying happens on Dodo Payments’ own checkout page, not here. Whatever they set while you are on their domain is theirs and governed by their policy; we never see it. When you come back, the only thing that returns with you is a payment reference we check against their API. See the terms for how that works.

Every browser can block or clear cookies for a single site, and any content blocker stops analytics before it loads. A browser set to send Do Not Track is honoured here as well: analytics does not start, and no cookie is set.

Nothing here depends on being watched. Scanning, downloading and a plan you have paid for all behave identically with analytics blocked, cleared or never loaded at all.

Questions about any of this can go to contact, and they reach a person.