Cookies and similar technologies

Strictly necessary authentication cookies

Supabase Auth sets first-party cookies (names typically beginning sb-) so your session persists securely between requests. These are essential for sign-in and signed-in areas of the application.

Referral attribution (first-party cookie)

When you land with a valid referral code in the URL, we may place a short-lived first-party HTTP cookie (tos_ref) so the platform can attribute a signup fairly. It is not used for third-party advertising networks.

Third-party marketing and analytics cookies

We do not use third-party advertising cookies. We do not rely on analytics cookies for PostHog — when enabled, PostHog stores its SDK state in browser localStorage after you opt in on this device. Vercel Web Analytics, described below, uses no cookies and no browser storage of any kind.

Product safety and analytics (PostHog, localStorage)

Deployments that set a public PostHog key expose the SDK so subscribers can choose to send minimal typed product events — for reliability observability, feature usage summaries, error/flow diagnostics, and proportionate indicators around safe AI-assisted flows. PostHog is not treated as strictly necessary for core sign-in or accounting; it stays off until you pick Allow in the prompt shown inside the app, or Allow product safety & analytics in the preference panel below. The prompt is not shown on our public pages, where these events are never sent. We must not transmit raw quote or proposal wording, uploaded files or names, prompts, completions, contacts, pricing line detail, or other sensitive customer content through these events — only lightweight metadata aligned with internal rules.

The SDK initialises with autocapture off and session replay disabled in the build we operate.

Aggregate traffic measurement (Vercel Web Analytics, no storage)

Our host, Vercel, counts page views so we can see how many people reach the site, which pages they land on, and roughly where they came from (referring site, country, device type, campaign tags in the link you clicked). This is aggregate measurement only.

It sets no cookies, writes nothing to localStorage or any other browser storage, and does not read anything already stored on your device. It does not build a profile of you, does not follow you across other websites, and does not identify you personally.

Because it stores nothing on your device, it is not covered by the product safety and analytics choice above and runs whether or not you opt in to PostHog. If you would rather it did not run at all, a tracker-blocking browser extension or your browser's built-in blocking will stop it.

Service worker / PWA cache

Our progressive web app registers a service worker so static assets and selected routes load faster offline or on poor connections. Cache entries are stored locally in your browser — they are not used to track you across unrelated sites. You can clear site data or uninstall the PWA from your device settings at any time.

Preference controls (this browser)

Your choice for product safety/analytics applies per browser profile and is stored locally as JSON under the key tradeos_privacy_preferences. Clearing site data resets it — you'll be asked again the next time you use the app.

Manage storage in your browser

You can also block or wipe cookies and local storage for Trade-OS from your device settings — that may log you out and remove referrals or analytics preference state until you revisit and choose again.