Cookie Policy
Last updated 20 October 2026
What cookies are
Cookies are small text files a website stores in your browser. Similar technologies, such as local storage, work the same way. They can be strictly necessary for a service to work, or used for things like analytics and advertising. The website and the app use PostHog for analytics, and, only if you accept, X's pixel to measure our ads on X, both described below. We never use cookies to show you ads on other websites.
Website analytics
We use PostHog, hosted in PostHog's EU region, to see which pages are read, which buttons are used and where the site is slow or broken. We send it identifiers, counts and page addresses, never what you type into our forms: for the contact form it only learns which topic you picked.
- Before you choose, or if you reject: PostHog counts visits without cookies and without storing anything on your device. Its servers turn your IP address and browser details, combined with a secret value that changes every day, into a one way code, so a visit can be counted without recognising you on another day. No recordings.
- If you accept: PostHog also sets the cookie below, with a random identifier, so it can tell visits and sessions apart. About 3 in 10 visits are also recorded (mouse movement, clicks, scrolling and what the page showed), with everything typed into form fields hidden before it leaves your browser. Recordings may be reviewed with AI (PostHog's Replay Vision, which uses Google's Gemini models) to spot broken pages.
- If your browser sends Global Privacy Control: PostHog doesn't load at all and we don't show the banner.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| kp_consent | Cookie set by Kairo Post, strictly necessary | Remembers your choice in the cookie banner (“granted” or “denied”). Shared with app.kairopost.com so you only choose once. | 180 days |
| kp_ph_consent | Local storage set by Kairo Post, strictly necessary | A copy of the same choice (1 or 0) for the PostHog script. Only exists after you choose. | Until you clear site data |
| ph_<project key>_posthog, ph_<project key>_window_id | Cookie and session storage set by PostHog, only after you accept | A random visitor identifier, the current session and browser tab, so pages and recordings from one visit belong together. | Up to 1 year; the session part ends when the tab closes |
Advertising measurement
We advertise Kairo Post on X. To learn which of our X ads work, and only if you accept, we use X's pixel and X's Conversion API. Nothing in this section happens before you choose, if you reject, or if your browser sends Global Privacy Control.
- On our website: X's pixel script loads from static.ads-twitter.com. It tells X that a page was visited and when you click “Add to Chrome”, so X can link that visit to an ad you saw or clicked on X. X may set or read its own cookies when it does this, under X's privacy policy.
- If you came from one of our X ads: the link carries X's click identifier. We keep it in the cookie kp_twclid below so that a sign up or payment that follows can be linked to that ad.
- When you sign up, start a checkout or pay: our servers tell X that it happened, with the click identifier if there is one and a one way code of your email address (a SHA-256 hash, so X can match it to an X account it already knows but can't read the address). For payments we add the amount and currency. We never send X your name, your email address itself, or anything you write in Kairo Post.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| kp_twclid | Cookie set by Kairo Post, only after you accept | X's click identifier from the ad that brought you, so a later sign up or payment can be linked to that ad. Shared with app.kairopost.com. Deleted when you reject. | 30 days |
| X's cookies | Set by X through its pixel on our website, only after you accept | Lets X measure its ads, under X's own policies. | Set by X |
In the app
The app at app.kairopost.com uses these strictly necessary cookies. They can't be switched off without breaking sign in, which is why the law doesn't require consent for them. The app also asks the same Accept or Reject question as the website (one choice covers both): until you accept, PostHog counts app use without cookies and without knowing who you are; after you accept, it sets the PostHog analytics cookie described above, links app use to your account id (never your name or email) and records sessions with everything you type and all post, message and brand content hidden. Admin screens, the Copilot side panel and shared draft previews are never recorded.
| Cookie | Purpose | Duration |
|---|---|---|
| Session token | Keeps you signed in and ties requests to your session. Secure and HTTP only, so page scripts can't read it. | Up to 7 days, renewed while you are active |
| Session cache | A signed, short lived copy of session details that avoids a database lookup on every request. | Minutes |
| Two step sign in | Remembers that you are part way through two step sign in, and, if you ask, that this device is trusted. | Minutes, or up to 30 days for a trusted device |
| Sign in with a provider | Protects the Google or GitHub sign in flow against forgery, if you use it. | Minutes |
Local storage
The app stores a few preferences in your browser, such as your selected workspace, theme and text size. They never leave your device and are removed when you clear site data.
Third parties
When you check out, our payment provider may set its own cookies on its pages under its policies. When you connect an X account, x.com sets cookies under X's policies. After you accept, X's pixel works as described under Advertising measurement. The app reports errors to our monitoring providers (Sentry, and PostHog after you accept) without your name, email or what you wrote.
Your choices
Choose Accept or Reject in the banner on our website or in the app. You can change your mind at any time with “Cookie settings” at the bottom of every website page or in the app's account menu; if you reject after accepting, PostHog removes its cookie and goes back to counting without cookies, we delete kp_twclid and stop telling X about visits, sign ups and payments. You can also block or delete cookies in your browser settings. Blocking the session cookie will stop you signing in to the app. If your browser sends Global Privacy Control, neither PostHog nor X's pixel loads on our website or in the app.
Contact
Questions about this policy: support@kairopost.com.