Cookie Policy
1. What cookies are
Cookies are small text files placed in your browser. We also use related technologies (localStorage, sessionStorage) for the same purposes. This policy covers all of them as "cookies" for simplicity.
2. Categories we use
2.1 Strictly necessary (no consent required)
| Cookie | Purpose | Duration |
|---|---|---|
| sb-access-token | Auth session (Supabase) | 1 hour rolling |
| sb-refresh-token | Auth refresh (Supabase) | 30 days |
| __Host-csrf | CSRF token | Session |
| fx_region | Remembers which regional consent rules apply to you | 24 hours |
These are required for the Service to function. They cannot be declined while you are signed in.
2.2 Functional (set when you save preferences)
| Cookie | Purpose | Duration |
|---|---|---|
| findrix_locale | Preferred language | 1 year |
| findrix_cookie_consent | Records your cookie choice (browser localStorage) | Until you delete it |
2.3 Analytics
| Service | Purpose | Duration |
|---|---|---|
| PostHog (eu.i.posthog.com) | Anonymized product analytics | 13 months |
| Google Analytics 4 (googletagmanager.com) | Traffic & usage analytics (_ga, _ga_* cookies; Google Consent Mode v2) | Up to 2 years |
Whether these run by default depends on where you are: see the regional table in section 3. Until analytics is allowed for you, Google Analytics sets no _ga cookies (Consent Mode stays denied) and no advertising pixel loads.
2.4 Advertising
We use a small set of advertising pixels to measure our own ad campaigns and build retargeting audiences. We do not show third-party ads on Findrix.
| Service | Purpose | Duration |
|---|---|---|
| Meta Pixel | Measures our Meta ad campaigns; retargeting audiences | Up to 90 days |
| LinkedIn Insight Tag | Measures our LinkedIn ad campaigns; retargeting audiences | Up to 1 year |
| OpenAI Ads pixel | Measures conversions from our ads shown in ChatGPT | Set by OpenAI |
| FirstPromoter | Credits the affiliate or partner who referred you to us | 90 days |
These load only where and when permitted (see section 3). Each provider's own privacy policy is linked on our sub-processor page.
3. How consent works in your region
Different places have different privacy laws (GDPR in Europe, CCPA/CPRA in the US, and similar), so the site behaves differently depending on where you visit from:
| Where you are | What happens by default | Your controls |
|---|---|---|
| European Economic Area, United Kingdom, Switzerland, Brazil, Japan, South Korea, Quebec (Canada) | Nothing is set. Analytics and ad measurement start only after you click "Accept all". | Cookie banner on your first visit. Change your mind anytime via "Cookie preferences" in the footer. |
| United States, Canada (outside Quebec), Australia | Analytics and ad measurement run unless you opt out. | Opt out anytime via the footer link (labelled "Do not sell or share my personal information" in the US). We also honor the Global Privacy Control browser signal automatically. |
| Everywhere else | Analytics and ad measurement run unless you opt out. | Opt out anytime via "Cookie preferences" in the footer. Global Privacy Control is honored here too. |
If we cannot determine your location, we err on the side of asking first: nothing runs until you accept, as if you were in the first row.
4. Manage your choice
Wherever you are, the "Cookie preferences" link in the footer lets you change your choice at any time (in the US it is labelled "Do not sell or share my personal information"). Withdrawing takes effect immediately.
Browser-level controls are also available. See your browser's help pages for "manage cookies".
5. Third-party cookies
Our advertising pixels are listed in section 2.4 above. Beyond those, the only third-party cookies come from sub-processors essential to the Service (Supabase, Stripe on paid tiers); the full list is on our sub-processor page.
6. Global Privacy Control
We honor the Global Privacy Control (GPC) browser signal everywhere outside opt-in regions: it acts as an automatic opt-out, so no analytics or marketing cookies are set and no pixel loads. In opt-in regions your explicit banner choice governs. We no longer treat the legacy Do Not Track flag as a consent signal (it has no legal effect and browsers ship it inconsistently); use GPC or the "Cookie preferences" link instead.
7. Updates
When we add new cookies, we update this page and re-prompt for consent on next visit.
8. Contact
Cookie questions: privacy@findrix.ai. See also our Privacy Policy.