Cookie policy

• •We set a small number of cookies to keep you signed in. Without them the app cannot work, so there is no way to switch them off and still use it.
• •We always count page views in aggregate. That specific count doesn't use a cookie or store anything identifying you, so there is nothing to opt out of there — see “Analytics, specifically” below for why.
• •If you accept, we also use PostHog for slightly richer page-view detail, and note which of our own marketing links brought you here. Both are optional, off until you accept, and you can change your mind any time.
• •We do not use advertising cookies, cross-site trackers, or third-party marketing pixels. There is no advertising network involved in this product at all.

Cookies that are strictly necessary to provide a service the user has asked for are exempt from consent under the UK PECR and the EU ePrivacy Directive. Keeping you signed in and protecting the sign-in form against cross-site request forgery both fall squarely in that category — if you have asked to sign in, a cookie that remembers you are signed in is not something we should have to negotiate.

We rely on that exemption for exactly those cookies and nothing else. Analytics is not necessary, so it asks.

Consent under the ePrivacy Directive is about storing or reading something on your device — a cookie, local storage, a fingerprint. Vercel Analytics does none of that: it counts a page view, doesn't set a cookie, and doesn't keep anything that could identify you again tomorrow. Nothing touches your device, so there is nothing here to ask permission for — which is why it runs on every visit rather than waiting for you to accept. We still disclose it, because you should know it happens even when we don't need to ask.

PostHog is different, and does ask: it's configured to recognise you as the same visitor across pages and, once you sign up, across visits — which is a real, if narrow, form of tracking, even with nothing else about you attached. PostHog's autocapture and session-recording features — on by default in a normal install — are switched off here; it sees page views and nothing else, and never builds an advertising profile or follows you to other sites.

We use both for one thing: deciding which pages are worth keeping and writing more of. You'll notice this policy has no analytics vendors beyond those two; a habit app does not need a data warehouse.

If you accept, and you arrive with a tracking link (say, from an ad or a newsletter), we set one more cookie recording the source, campaign, and the page you landed on. Unlike the analytics above, this one is tied to your account: if you go on to sign up, that first visit's source is saved on your account record, once, and never updated by a later visit. It exists purely so we know which of our own marketing efforts are worth continuing — it is never sold, shared, or used to target ads to you.

Use the button above, or the Cookie settings link in the footer of every page. Withdrawing consent stops collection immediately for the rest of your session — you don't need to reload.

If you're signed in, your choice is stored against your account as well as in your browser, so it follows you to a new device instead of resetting. You can also clear cookies and site data in your browser at any time, which resets everything and means the banner will ask again.

For what we do with the data behind those cookies — and everything else we hold — see the privacy policy.