1. Introduction
This Cookie Policy explains how OTAlytics ("we," "us," or "our") uses cookies and similar tracking technologies when you visit our website and use our services.
This policy should be read in conjunction with our Privacy Policy, which provides more detail about how we collect and use your personal data.
We treat our public marketing website and the authenticated OTAlytics application differently. On the public marketing site, non-essential cookies are only set after you give consent through our cookie banner. Inside the authenticated application, we use product analytics to run and improve the Service; this is controlled by a setting in your account rather than by the banner, as described in Section 5 and in our Privacy Policy.
The cookie banner governs what is stored in or read from your browser. It does not govern analytics events that our backend records on its own servers while handling requests you make to the Service (server-side analytics), because that processing does not store or read anything on your device. Server-side analytics is covered in our Privacy Policy and is controlled by the account setting described in Section 5.3.
2. What Are Cookies?
Cookies are small text files that are placed on your device (computer, smartphone, or tablet) when you visit a website. Cookies are widely used to make websites work more efficiently and provide information to website owners. Some tracking technologies store data in your browser without using cookies (for example, in local storage); we treat those the same way as cookies in this policy.
2.1 Types of Cookies by Duration
- Session Cookies: Temporary cookies that expire when you close your browser. Used for essential functions like keeping you logged in during a session.
- Persistent Cookies: Cookies that remain on your device for a set period or until you delete them. Used to remember your preferences and settings.
2.2 Types of Cookies by Purpose
- Strictly Necessary Cookies: Essential for the website to function. Without these, services you request cannot be provided.
- Functional Cookies: Enable enhanced functionality and personalization, such as remembering your preferences.
- Analytics Cookies: Help us understand how visitors and signed-in users interact with the Service so we can improve it. Inside the authenticated application these analytics are linked to your account (see Section 3.3), so they are not anonymous.
- Marketing Cookies: Track your activity across websites to deliver relevant advertising (we currently do not use these).
2.3 First-Party vs. Third-Party Cookies
- First-Party Cookies: Set by OTAlytics directly.
- Third-Party Cookies: Set by external services we use (e.g., Supabase, PostHog).
3. Cookies We Use
Below is a detailed list of cookies used by OTAlytics:
3.1 Strictly Necessary Cookies
These cookies are essential for you to use our Service and cannot be disabled without severely affecting functionality.
| Cookie Name | Purpose | Duration |
|---|
sb-access-token | Stores your authentication token to keep you logged in | Session |
sb-refresh-token | Allows automatic session renewal without re-login | 30 days |
3.2 Functional Cookies
These cookies enable personalization and remember your preferences.
| Cookie Name | Purpose | Duration |
|---|
theme | Remembers your dark/light mode preference | 1 year |
language | Stores your language preference | 1 year |
3.3 Analytics Cookies
We use PostHog to understand how users interact with the Service so we can improve it. Where PostHog is active, analytics events inside the authenticated application are linked to your account by a pseudonymous internal user identifier and coarse account attributes (subscription tier and account creation date). We do not attach your email address to your analytics profile. Because the events are linked to your account, these authenticated analytics are not anonymous.
Where PostHog stores ph_* cookies or other browser storage depends on where you are:
- Public marketing website: PostHog uses
ph_* cookies and local storage, and only after you accept analytics in the cookie banner. Until you accept, nothing is stored. - Authenticated application: PostHog runs in memory only. It does not write
ph_* cookies or local storage to your device in the authenticated application; analytics there is disclosed in our Privacy Policy and controlled by your account setting (Section 5.3), not by browser cookies.
| Cookie Name | Purpose | Duration |
|---|
ph_* | PostHog analytics cookies for product and feature usage. Set on the public marketing website only, and only after you accept analytics in the cookie banner. Not set in the authenticated application (memory only). | 1 year |
4. Third-Party Cookies
Some cookies are set by third-party services we use. We have no control over these cookies. The third parties can update their cookies and privacy policies at any time.
4.1 Supabase (Authentication)
Purpose: User authentication and session management
Cookies: sb-* cookies for login sessions
Privacy Policy: https://supabase.com/privacy
4.2 PostHog (Analytics)
Purpose: Product analytics and feature usage tracking
Cookies: ph_* cookies on the public marketing website only, after you accept analytics; the authenticated application runs PostHog in memory and sets no ph_* cookies
Data Collection: Page views, button clicks, feature usage, and (inside the authenticated application) a pseudonymous internal user identifier and coarse account attributes. We do not send your email address to PostHog.
Privacy Policy: https://posthog.com/privacy
4.3 Stripe (Payment Processing)
Purpose: Secure payment processing and fraud prevention
Cookies: Used during checkout process only
Privacy Policy: https://stripe.com/privacy
5. Cookie Consent
5.1 Strictly Necessary Cookies
Because strictly necessary cookies are essential for the Service to function, they do not require your consent. These cookies are automatically set when you use the Service.
5.2 Public Marketing Website
On our public marketing website, non-essential cookies (including analytics cookies) are not set until you give consent. When you first visit the site, we present a cookie banner where you can accept or decline non-essential cookies. Until you accept, only strictly necessary cookies are used. The banner controls browser storage on the marketing site; it does not control the authenticated-application analytics described in Section 5.3.
5.3 Authenticated Application — Product Analytics
Inside the authenticated OTAlytics application, we process product analytics — captured both in your browser and on our backend — to operate, secure, and improve the Service. As explained in our Privacy Policy, we rely on our legitimate interests under Article 6(1)(f) GDPR as the legal basis for this processing rather than on consent. In the authenticated application, browser-side analytics runs in memory and does not store ph_* cookies or local storage on your device, and server-side analytics does not store or read anything on your device; neither is therefore governed by the cookie banner.
You control this analytics through a setting in your account. Your account settings include a self-service toggle to object to product analytics; when you use it, we stop immediately, without requiring any justification, and for both browser-side and server-side capture. You can also enable the "Do Not Track" signal in your browser, which we honour for browser-side capture (see Section 6.2 for how Do Not Track applies).
5.4 Session Replay
Session replay, which records how you interact with the interface, is a separate and more invasive feature than analytics, and is treated separately. It is off by default. It is only enabled if you explicitly opt in to replay — accepting analytics does not enable it, because being recorded is a distinct choice.
When replay is enabled, all text inputs are masked, so the contents of form fields (for example keywords, competitor names, tour titles and pricing) are not recorded. Replay is additionally suppressed on sensitive pages — account settings, pricing, billing and checkout — regardless of your choice. Replay is subject to the same controls as our other analytics: it does not run if you have not consented, if your browser sends a Do Not Track signal, or if you have objected via your account settings.
6. How to Manage Cookies
6.1 Browser Settings
Most web browsers allow you to manage cookie preferences through their settings. You can:
- Delete all cookies
- Block all cookies
- Allow only first-party cookies
- Get notified when a cookie is set
Note: Blocking necessary cookies will prevent you from using our Service. Blocking analytics cookies will not affect functionality.
6.2 Do Not Track
"Do Not Track" (DNT) is a browser signal about device-level tracking. It is not a formal GDPR objection and has no binding legal status — the underlying W3C standard was discontinued. We nonetheless honour it as follows:
- Browser-side (client) capture: If your browser sends a DNT signal, we disable browser-side PostHog analytics for that browser.
- Server-side capture: DNT is a browser setting and does not govern analytics events our backend records on its own servers. To object to all product analytics, including server-side capture, use the account-settings toggle described in Section 5.3, which is the correct and disclosed control for it.
6.3 Browser-Specific Instructions
6.4 Opt Out of Analytics
To opt out of PostHog analytics, you can:
- Authenticated application: Use the self-service toggle in your account settings to object to product analytics. This stops both browser-side and server-side capture immediately, and is the only control that covers server-side capture (see Section 5.3).
- Enable "Do Not Track" in your browser, which we honour for browser-side capture only (see Section 6.2).
- Decline analytics cookies in the cookie banner on our public marketing website.
6.5 Mobile Devices
For mobile browsers, consult your device's documentation for cookie management:
- iOS: Settings > Safari > Block All Cookies
- Android: Settings > Privacy > Clear browsing data
7. Updates to This Policy
We may update this Cookie Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by:
- Posting a notice on our website
- Updating the "Last Updated" date at the top of this policy
- Sending an email notification for significant changes
We encourage you to review this policy periodically to stay informed about our use of cookies.
Your Privacy Matters
We are committed to transparency about our data collection practices. If you have any concerns about cookies or privacy, please reach out to us. We're here to help and ensure you have control over your data.