1. What Are Cookies and Storage Technologies?
Cookies are small text files placed on your device by websites you visit. They are widely used to make websites function securely, preserve authenticated sessions, and provide operational integrity.
In addition to cookies, modern web applications utilize browser Local Storage (HTML5 Web Storage), which stores key-value pairs locally within your browser without sending them with every HTTP request header.
2. Our Verified Browser Behavior & Privacy Rules
Distrarc adheres to a privacy-first principle: we do not use advertising cookies, and we do not build advertising profiles or track you across the web. The only optional technologies we use are PostHog and Google Analytics. They set no cookies and store no identifier unless you accept.
Our cookie behavior is derived directly from empirical browser behavior:
- PostHog: Before you choose, after Decline, and with a privacy signal, PostHog counts public page views only, with no cookie, no storage and no session recording. After Accept it also stores an identifier and records masked sessions. It is not loaded inside the signed-in product. If Google Analytics is switched on, it loads only after you choose Accept.
- No Optional Cookies: Distrarc sets no advertising cookies, no third-party trackers, and no optional cookies without explicit user consent.
- Session Cookies: The
distro_sessioncookie is strictly necessary for signed-in navigation. It holds a random token. The server stores only a hash of that token. - Your choice is remembered: Accept or Decline is stored in one first-party cookie,
distrarc_consent, for one year. We set no advertising cookies and no other preference cookies. - Privacy signals: If your browser sends Global Privacy Control or Do Not Track, we treat that as a decline, load no Google Analytics, set no PostHog cookie or recording, and show no banner.
- Server-Side Telemetry Opt-Out: Platform telemetry runs server-side and is controlled by the telemetry opt-out in your account Settings, not by any browser cookie or script.
3. Detailed Inventory of Cookies and Storage
The following table lists every cookie and local storage item that Distrarc sets on distrarc.com as of this date:
| Name / Key | Type & Domain | Lifespan | Category | Purpose |
|---|---|---|---|---|
| distro_session | HTTP Cookie (First-party, HttpOnly, Secure over HTTPS, SameSite=Lax) | 30 days | Strictly Necessary | Authenticates active founder session across the /app workspace. Deleted on sign out. |
| distrarc_consent | First-party cookie set by our site script, SameSite=Lax, Secure over HTTPS | 1 year | Preference | Remembers whether you accepted or declined analytics so we do not ask again. Contains only the word granted or denied. |
| distrarc_run | First-party HttpOnly cookie, SameSite=Lax, Secure over HTTPS | 30 days | Strictly Necessary | Identifies an in-progress free opportunity report run during signup. The raw value never reaches the database; deleted upon claim or sign out. |
| distrarc_onboarding_intent | First-party HttpOnly cookie, SameSite=Lax, Secure over HTTPS | 30 minutes | Strictly Necessary | Binds your website to a single-use email verification request. Deleted when verification succeeds or you start again. |
| _ga | First-party cookie set by Google Analytics, only after you accept | Up to 2 years | Analytics (optional) | Random identifier that lets Google Analytics tell visits from the same browser apart. Removed when you decline or withdraw. |
| _ga_<ID> | First-party cookie set by Google Analytics, only after you accept | Up to 2 years | Analytics (optional) | Keeps session state for our Google Analytics property. Removed when you decline or withdraw. |
| ph_<key>_posthog | First-party cookie and local storage item set by PostHog, only after you accept | Up to 1 year | Analytics (optional) | Random identifier and session state so PostHog can tell visits from the same browser apart. Removed when you decline or withdraw. |
| distrarc.tour | Local storage item in your browser only (not sent to our servers) | Until you clear browser storage | Preference | Remembers how far you got in the in-app tour so it does not start again. Read only in the app. |
4. Categories of Cookies We Use
A. Strictly Necessary Cookies
These cookies are vital for the core functionality and security of the Platform. They allow you to securely log in, access authenticated workspaces, navigate between application screens, and maintain session integrity. Because the Platform cannot operate securely without them, strictly necessary cookies cannot be disabled.
B. Analytics Cookies (Optional, PostHog and Google Analytics)
We use PostHog (PostHog Inc., US or EU Cloud) to count visits and see which public pages work. Without consent it sends page views only, with no cookie or storage. After you accept, it also uses cookies and local storage, autocaptures clicks without element text, and records sessions with every form field masked. We send no email address, name or form input value, no query strings, and nothing from the signed-in product, API, invitation or sign-up setup pages. Withdrawing stops PostHog and deletes its cookies and storage we can reach.
If switched on, and with your consent, we use Google Analytics 4, provided by Google LLC, to count visits and see which public pages are useful. This is a measurement purpose only. We use Google Consent Mode, so all Google storage is denied by default, and we turn on only analytics storage after you accept. Advertising storage, advertising data sharing, ad personalization and Google signals stay off.
- What is sent: page address without any query string, page title, referring site, browser and device type, language and approximate location derived by Google from your IP address. For pages inside the signed-in workspace and for sign-in or invitation links we send only the top-level section name, never identifiers or tokens. We send no email address, name or account identifier.
- IP addresses: Google Analytics 4 does not log or store IP addresses. Google uses the IP address in transit to infer approximate location and then discards it. Your IP address is necessarily visible to Google when your browser contacts it.
- Retention: event-level data is kept in our Google Analytics property for the retention period configured there, which is never longer than the 14 months that Google allows. Aggregated reports are not affected by that setting.
- Where: Google may process this data in the United States and other countries where it operates.
Google Analytics is not used for advertising and is separate from the optional server-side telemetry described below.
C. Server-Side Telemetry (Not a Cookie)
Platform telemetry in Distrarc is handled via a server-side event exporter with salted HMAC pseudonyms. This backend exporter loads no browser tracking scripts, sets no cookies, and performs no browser fingerprinting. It is entirely separate from the optional PostHog and Google Analytics 4 browser integrations above, which store identifiers only after you choose Accept in the cookie banner. You can opt out of server-side telemetry at any time with the telemetry control in your account Settings.
5. Change or Withdraw Your Choice
You can accept or withdraw analytics consent at any time with the control below. Withdrawing stops PostHog and Google Analytics, and we delete their cookies we can reach on this site. Withdrawing does not remove data already collected; it is covered by those providers' retention periods. You can also clear cookies in your browser, or send a Global Privacy Control signal.
6. How to Control Cookies in Your Browser
Most web browsers allow you to control cookie settings through their preferences or settings menus. Please note that disabling strictly necessary cookies may prevent you from signing in to Distrarc or accessing your account.
7. Updates to This Cookie Policy
We may update this Cookie Policy from time to time to reflect modifications in our technical infrastructure or applicable legal obligations. Any changes will be posted here with an updated “Last updated” date.
8. Contact Us
If you have questions about our use of cookies or tracking technologies, please contact our privacy team at privacy@distrarc.com.