This policy describes an intended setup and is not legal advice. Confirm the actual cookie names and lifetimes your deployment sets, complete every highlighted placeholder, and have it reviewed — a cookie banner with genuine reject-all is a hard requirement for EU/UK visitors.
The short version
No advertising cookies. No third-party tracking pixels. No data brokers. No selling anything.
We set the minimum needed to keep you signed in, plus optional analytics that help us see where people get stuck. You can decline the optional ones and the product works exactly the same.
"Reject all" is a real button, given equal weight to "accept" — not hidden behind three clicks of a preferences panel.
01What cookies are
Small text files a website stores in your browser. Some are essential — without them, you couldn't stay signed in between pages. Others are optional and help the people running the site understand how it's used.
This policy also covers similar technologies such as localStorage and sessionStorage, which do much the same job.
This sits alongside our Privacy Policy, which explains everything else we do with data.
02Essential cookies
These are required for the Service to function. They can't be switched off, because switching them off means you can't sign in. We rely on the "strictly necessary" exemption, so we don't ask consent for these.
| Name | Purpose | Lifetime |
|---|---|---|
| sb-access-token | Keeps you signed in | 1 hour |
| sb-refresh-token | Renews your session so you're not signed out constantly | 30 days |
| imbew-consent | Remembers your cookie choices, so we stop asking | 12 months |
| imbew-tz | Your timezone, so the daily email arrives at the right hour | 12 months |
03Analytics — optional
We use PostHog to understand which features are used and where people abandon a flow. This is genuinely how the product gets better; it is also entirely optional and refusing costs you nothing.
| Name | Purpose | Lifetime |
|---|---|---|
| ph_[key]_posthog | Distinguishes one visitor from another and records feature usage | 12 months |
Set to off until you accept. IP addresses are truncated, and analytics data is deleted or fully anonymised after 14 months. We do not use it to build advertising profiles, and we do not share it with advertisers — because we don't have any.
04Session replay — optional, and off by default
PostHog can record an anonymised replay of on-page interaction — clicks, scrolls, where a cursor hesitated. It's how we find confusing screens without asking you to sit through a call.
Off unless you opt in separately. Accepting analytics does not switch this on.
Text you type is masked. Your interpretations, reflections, and email address are never captured in a recording — we see that a field was filled, not what went into it.
Recordings are deleted after 30 days, and are never linked to marketing or shared with any third party.
05What we don't use
Stated explicitly, because in this category the absence is the point:
- No advertising or retargeting cookies.
- No Meta Pixel, no Google Ads tag, no TikTok pixel, no LinkedIn Insight tag.
- No third-party data brokers or enrichment services.
- No cross-site or cross-device tracking.
- No social media embeds that track you.
- No fingerprinting.
If this ever changes, we will update this page and ask for fresh consent before setting anything new. We won't quietly add a pixel.
One external dependency worth naming: we load fonts from Google Fonts, which means your browser makes a request to Google's servers and your IP address is visible to them in the process. [If self-hosting fonts, delete this paragraph — self-hosting removes the issue entirely and is worth doing.]
06Your control
- On first visit you get a banner with "Accept" and "Reject all" given equal prominence. Rejecting is one click.
- Any time after, change your mind from the "Cookie settings" link in the footer.
- In your browser, block or delete cookies through its settings. Blocking essential cookies will stop sign-in from working.
- Global Privacy Control — if your browser sends a GPC signal, we treat it as a refusal of optional cookies automatically. You don't need to do anything.
07Changes
If we add or change a cookie category, we'll update this page, refresh the date at the top, and ask for consent again where the law requires it.
08Contact
Questions about any of this: privacy@imbew.com
[LEGAL ENTITY NAME, REGISTERED ADDRESS]