Cookie Policy

1. What are cookies?

Cookies are small text files placed on your device when you visit a website. We also use comparable technologies such as local storage and tracking pixels. In this policy, we refer to all of them as “cookies” for simplicity.

2. Cookie categories we use

Strictly necessary (always on)

These cookies are required to deliver the service you actively requested. They cannot be switched off. Without them, sign-in, subscriptions, and CSRF protection would not work.

• NextAuth session cookie— keeps you signed in.
• NextAuth CSRF token— protects against cross-site request forgery on auth forms.
• spinshare_ref, spinshare_invite — short-lived attribution cookies for invite and referral links.

Preferences

These cookies remember choices you make (such as light/dark mode or recently selected views) so the interface stays consistent between visits.

• Local storage entries used by the dashboard sidebar to remember which view you last selected.

Analytics (consent-based)

We use PostHog to understand how producers and subscribers use Spinshare so we can improve the product. Analytics cookies are only loaded after you give consent.

• ph_did— long-lived pseudonymous ID used for consistent feature-flag bucketing.
• PostHog autocapture and session replay— page views, UI clicks, and masked-input session replays.

TODO: engineering work required to gate the ph_did cookie and PostHog tracker behind explicit consent, and to expose a re-consent / withdraw-consent control.

Marketing

We currently do not run marketing pixels or third-party advertising cookies. If we add them in the future, they will be listed here and gated behind your consent.

3. Your choices

You can accept, reject, or change your consent for non-essential cookies at any time using our cookie banner or the cookie settings link in our footer. You can also block cookies in your browser settings, but doing so may impair sign-in and other essential features.

TODO: implement a compliant consent banner and a re-open control in the footer.

4. Cross-border transfers

Some of our cookie partners (e.g. PostHog Inc., Vercel Inc.) are based outside the EEA. Where personal data is transferred to such partners, we rely on the EU Standard Contractual Clauses and any available adequacy decision.

5. Updates to this policy

We may update this Cookie Policy from time to time. The “Last updated” date at the top reflects the latest revision.

6. Contact

Questions about cookies? Email support@spinshare.pro.