Legal
Cookie Policy
Last updated: July 29, 2026
1. Essential cookies
Essential cookies support authentication, security, session continuity, and consent state. Storing or reading information that is strictly necessary to deliver a service you requested does not require prior consent under the EU ePrivacy Directive (Art. 5(3)), the UK Privacy and Electronic Communications Regulations (PECR), and equivalent national rules (including § 165 TKG in Austria and § 25 TDDDG in Germany), so these cookies are set without a consent gate.
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
| sb-access-token / sb-refresh-token | Supabase Auth | Session authentication | 1 hour / 30 days |
| ap-cookie-consent | BridgeReview.AI | Stores your cookie consent choice (purposes, timestamp, policy version) and a random consent ID used only to keep the record of that choice (section 6) | 12 months |
2. Analytics without cookies (no consent gate)
We use Vercel Web Analytics and Vercel Speed Insights in their cookieless mode. They collect anonymous page-view and performance aggregates, do not set cookies, do not store IP addresses, and do not identify individual visitors. Because no personal data is processed in a way that requires consent under GDPR/ePrivacy, these operate without a consent gate. Learn more at vercel.com/docs/analytics/privacy-policy.
3. Optional analytics cookies (consent required)
The following tools are integrated in the product and load only after you choose "Accept" in the cookie banner. Until then no script is downloaded, no cookie is written, and no request is sent to the provider. If you withdraw consent, collection stops. Where a tool is not configured for an environment, it never loads at all.
| Name | Provider | Purpose | Lifetime |
|---|---|---|---|
| ph_<project-key>_posthog | PostHog (EU ingest, eu.i.posthog.com) | Product analytics: page views and feature usage. Requests are proxied first-party via /ingest. Person profiles are only created for signed-in users; session replay, if enabled, masks all text and inputs. | 12 months |
| _ga, _ga_<container-id> | Google Analytics 4 (Google, US) | Aggregate traffic and campaign attribution. Transfers to the US are covered by the safeguards described in the Privacy Policy. | up to 24 months |
We do not run advertising or retargeting pixels, and we do not sell or share personal information for cross-context behavioural advertising.
4. Global Privacy Control
If your browser or extension sends the Global Privacy Control signal, we treat it as a valid opt-out: the optional analytics in section 3 are switched off automatically when you arrive, no analytics script is loaded, and no consent banner asks you to reconsider. You can still opt in deliberately via "Cookie settings" if you want to.
5. Managing consent
You can change or withdraw your cookie preferences at any time from the footer "Cookie settings" link — withdrawing is as easy as giving consent. Choosing "Essential only" leaves the cookieless analytics in section 2 running, because they process no personal data. Your choice is stored for 12 months; after that we ask again.
6. Record of your consent
Data protection law requires us to be able to demonstrate that consent was actually given (Art. 7(1) GDPR), and that withdrawing it was as easy as giving it (Art. 7(3)). The consent cookie alone cannot show that, because it sits on your device and you can clear it at any time. Each decision you make in the banner is therefore also recorded on our side.
That record contains only: the random consent ID from your consent cookie, which purposes you allowed or declined, the policy version you decided against, whether the decision came from a click or from a Global Privacy Control signal, and the time of the decision. It deliberately contains no IP address, no browser or device information, and no link to any user account. Your IP address is used to rate-limit the request and is never stored with the record.
The record is append-only: withdrawing consent adds a new entry rather than editing the old one, because the history is precisely what has to be demonstrable. Entries are kept for as long as we may need to evidence the decision and are not used for analytics, profiling, or any other purpose.