Cookie Policy
Version 2.1 — Last updated: 23 June 2026
1. About this policy
This policy explains how OneSixth uses cookies and similar technologies, in line with the Privacy and Electronic Communications Regulations 2003 (PECR) and the UK General Data Protection Regulation (UK GDPR). Cookies are small text files stored on your device when you visit a website.
We use a consent banner that lets you accept or reject non-essential cookies with equal prominence. You can review or change your choice at any time on the Cookie Preferences page or via the floating cookie button.
2. Strictly necessary cookies
Required for the service to function. These are set without consent because they are strictly necessary to deliver a service you have requested.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
| sb-*-auth-token | Supabase | Maintains your authenticated session | Session / 7 days |
| cookie_consent | OneSixth | Stores your cookie preferences | 12 months |
| __stripe_mid / __stripe_sid | Stripe | Fraud prevention on the checkout page (set only when you reach billing) | Up to 1 year / 30 minutes |
3. Analytics cookies
We use PostHog (PostHog Inc.) for product analytics to understand how the app is used and to improve it. PostHog records page views and page-leave events and stores an anonymous device/session identifier using both browser cookies and local storage. When you are signed in, we may associate this analytics data with your account (including your user ID and email), so identifiable information can be sent to PostHog. PostHog is hosted on PostHog Cloud EU (Frankfurt), so this data is stored in the European Union. Before any URL is sent to PostHog we redact sensitive query parameters (for example OAuth codes and access/identity tokens) so they are never captured in analytics. We do not use analytics for advertising and do not sell this data.
We also use Google Analytics 4 (Google Ireland Ltd.) to measure traffic and understand how visitors find and move through our website. Google Analytics sets first-party cookies and stores an anonymous client identifier; we enable IP anonymisation and suppress the automatic initial pageview, and we redact sensitive query parameters (such as OAuth codes and access/identity tokens) before any URL is sent to Google. We do not use it for advertising and do not sell this data. For details of how Google processes this data, see Google's Privacy Policy and how Google uses data from sites that use its services.
PostHog and Google Analytics run across both our public website and the signed-in application, always with the safeguards above (sensitive-URL redaction, and IP anonymisation for Google Analytics).
We also use Microsoft Clarity (Microsoft Corporation) to see how visitors use our public website through behavioural metrics, heatmaps and session replay, so we can find and fix usability problems. Clarity uses first- and third-party cookies and similar tracking technologies. To protect your data, Clarity only runs on public marketing, content and legal pages — it does not run on the sign-in, sign-up or authenticated application screens, so your clients' financial data is never recorded. Microsoft acts as an independent controller for this data; for details of how Microsoft collects and uses it, see the Microsoft Privacy Statement.
| Cookie / technology | Provider | Purpose | Duration |
|---|---|---|---|
| ph_* / posthog | PostHog | Product analytics — page views and feature usage | Up to 12 months |
| _ga / _ga_* / _gid | Google Analytics | Traffic measurement and visitor journeys (IP anonymised) | _gid 24 hours / _ga up to 2 years |
| _clck / _clsk / CLID | Microsoft Clarity | Heatmaps and session replay to diagnose usability issues | Up to 1 year |
Analytics are non-essential and are only initialised after you accept analytics cookies in our cookie banner. You can change your choice at any time on the Cookie Preferences page; declining or withdrawing consent stops further analytics collection (including PostHog, Google Analytics and Microsoft Clarity).
4. Marketing cookies
We do not use marketing cookies, advertising pixels or cross-site trackers. If this changes, we will update this page and seek your consent first.
5. Local storage and similar technologies
The Supabase JavaScript client uses browser local storage to keep authentication state between page loads. This is strictly necessary to keep you signed in. We also store small UI preferences (e.g. "dismiss" flags for in-app notices) locally; these never leave your browser.
We use Sentry (Functional Software, Inc.) for application error monitoring and performance diagnostics, hosted in Sentry's EU data region. Sentry helps us detect and fix faults and is used on the basis of our legitimate interest in a secure, reliable service; it does not set cookies and does not record session replay. See our Privacy Policy and Sub-processors page for details.
6. Managing cookies
You can review or change your cookie choices at any time on our Cookie Preferences page. You can also control cookies via your browser:
Blocking strictly necessary cookies will prevent you from signing in or paying for a subscription.
7. Contact
For questions about our use of cookies, contact privacy@onesixth.app.