Legal
Cookie Policy
Last updated · Version cookies-2026-07-01
What this covers
This Cookie Policy explains the cookies and similar technologies Smart Site Plan uses, why we use them, and how you can control them. It supplements our Privacy Policy. Cookies are small files stored in your browser; we also use comparable browser storage (such as localStorage) for the same purposes, and the controls below apply to both.
Essential cookies
These are strictly necessary for the Service to work, so they cannot be turned off. They keep you signed in, secure your session, and store your cookie choice. In production the sign-in cookies carry the __Secure- prefix and are set with the HttpOnly, Secure, and SameSite=Lax attributes.
| Name | Purpose | Provider | Lifetime |
|---|---|---|---|
| better-auth.session_token | Keeps you signed in and secures your session. | Smart Site Plan (first-party) | Up to 30 days |
| better-auth.session_data | Short-lived cache of your session so pages load without a round trip. | Smart Site Plan (first-party) | A few minutes |
| better-auth.two_factor | Tracks a pending two-factor step while you sign in. | Smart Site Plan (first-party) | Sign-in attempt |
| better-auth.trust_device | Remembers a device you marked as trusted so two-factor is not asked every time. | Smart Site Plan (first-party) | Until it expires or you sign out |
| better-auth.state | Protects single sign-on and OAuth redirects against cross-site request forgery. | Smart Site Plan (first-party) | Sign-in attempt |
| ssp:cookie-consent-v1 | Remembers your analytics cookie choice. Stored in your browser; not a tracking cookie. | Smart Site Plan (first-party) | Until you clear it |
| ssp_consent_region | Records which privacy regime applies to your visit, so we apply the correct default and only show the consent banner where the law requires one. It holds one of two words and no location detail. | Smart Site Plan (first-party) | 24 hours |
First-party attribution
On your first visit we set a first-party cookie named ssp_attribution (up to 90 days) that remembers the page you arrived on, any campaign tags, and which button or card on our own site you clicked before signing up, so we can understand how people find us and what convinced them. If you create an account, that same information is stored once with your account. It is first-party, is never shared with advertisers, and is not used for advertising or cross-site tracking. You can clear it at any time through your browser settings. If your browser sends a Global Privacy Control signal (see below), we keep optional analytics off; the attribution cookie remains first-party only.
Optional analytics
We use PostHog product analytics to understand how the product is used so we can improve it. Which default applies to you depends on where you are:
- European Economic Area, United Kingdom, Switzerland, Brazil, and Quebec: the law requires your consent before we store anything non-essential on your device, so analytics stays off until you opt in through the cookie banner.
- Everywhere else, including the United States: no consent is required in advance, so analytics is on by default and you can turn it off whenever you want. We show no banner, because a standing control and a respected Global Privacy Control signal are what these laws ask for.
Either way the control is the same and it is always available: the analytics control on the Privacy Policy page, which remembers your choice on this device. We do not use advertising cookies and do not sell or share your data with advertising networks.
| Name | Purpose | Provider | Lifetime |
|---|---|---|---|
| ph_* (e.g. ph_<id>_posthog) | PostHog product-analytics identifier and event buffer, used to understand how the product is used so we can improve it. Set only where analytics is active: after you opt in in a consent-required region, or until you opt out elsewhere. | PostHog (third-party) | Up to 12 months |
Managing cookies
You can control cookies in several ways:
- Use the analytics toggle on our Privacy Policy page to opt in or out of analytics at any time.
- Use your browser settings to block or delete cookies. Blocking essential cookies will stop you from signing in.
- Global Privacy Control: if your browser or an extension sends a GPC signal, we treat it as a request to keep optional analytics off, in every region and regardless of any earlier choice. We do not load PostHog, and the cookie banner is not shown, so you are not asked again.
Changes and contact
We may update this Cookie Policy from time to time. For questions, contact [email protected].