Cookie Policy

A cookie is a small text file a website stores in your browser. We also use functionally equivalent technologies (localStorage, sessionStorage) for the same purposes, and this page covers them too.

These keep the site working and are always on.

sb-…-auth-token — local storage: your Supabase sign-in session. Kept until you sign out.

xalgorix_consent_v1 · xal_consent — local storage and a first-party cookie (1 year): your cookie choice, so we can respect it on every page and at checkout.

xalgorix.theme · xalgorix.locale — local storage: your theme and language.

xalgorix_onboarding_dismissed_v1:… — local storage: that you dismissed the dashboard checklist.

xalgorix_ref — local storage: the code from a referral link you followed, until it is applied to your account.

xalgorix_chunk_reload — session storage: lets the page reload once if a new release replaced the code it was running.

When you arrive from a link with campaign tags (utm_…), an ad click, or another website, we remember where you came from so we can tell which campaigns lead to sign-ups and purchases. This is first-party: we keep it with your account and order records and add it to the analytics events described below.

x_utm — first-party cookie (90 days).

xalgorix_utm_first · xalgorix_utm_last — local and session storage: the first and latest campaign, kept until you clear site data.

x_conversion:… — local storage: stops us reporting the same purchase twice.

PostHog — product analytics, hosted in the United States: pages viewed, clicks, and session replays of our public pages, with every typed value masked. When you are signed in, events are linked to your account ID, email, and plan. Replay never runs in the signed-in app, on shared reports, on team invites, or on password reset, and autocapture is off on those pages. Stored as ph_… (cookie and local storage).

Google Analytics — page views and key events such as sign-up and scan started. Cookies _ga and _ga_… (up to 2 years).

Ahrefs Web Analytics — page views and referring sites, loaded through Google Tag Manager.

These tell us which ads bring visitors and customers. We do not sell your data.

Google Ads and Google Tag Manager — conversion measurement for Google ads. Cookies _gcl_… (90 days).

Meta Pixel — page views and conversions. Cookie _fbp (90 days).

X (Twitter) Pixel — page views and conversions; X sets its own cookies.

x_twclid — first-party cookie (90 days): the click id when you arrive from an X ad. When you buy a plan or credits, our server reports the purchase to X with a SHA-256 hash of your email (and this click id, if you have one) so X can attribute it to an ad. Nothing is sent if advertising measurement is not allowed for you.

In the EEA and the UK, analytics and advertising measurement stay off until you click Accept; until then Google's tags run in Consent Mode without setting cookies. Everywhere else they run unless you click Decline. If we cannot tell where you are, we treat you as being in the EEA.

Declining stops PostHog and removes its identifiers, withdraws consent from Google and Meta, and deletes the X click id. Pixels that had already loaded stop from the next page you open.

On pages that carry a private link — shared reports and team invites — the Meta, X and Ahrefs tags never run.

You can also use Cookie settings at the bottom of every page.

The analytics and advertising providers above set their cookies under their own policies. Signing in with Google and paying through our payment processor (Dodo Payments) take you to their sites, which set their own cookies; we cannot read them.

Browsers' Do Not Track and Global Privacy Control signals do not change these defaults today. Use Decline (or Cookie settings) to turn off analytics and advertising measurement.

You can also clear cookies and site data in your browser settings. Clearing the Supabase sign-in entry signs you out, and clearing your cookie choice brings the banner back.

We update this page whenever what we store changes, and ask for your consent again before adding anything that needs it.