Cookie Policy

This page lists the cookies and similar browser storage Indexbrain uses, what each one is for, and how long it lasts. It describes what the product actually does today; where something is still changing, it says so rather than describing an intention.

Cookies we need to run the service

Without these, signing in does not work. They are set because you used the product, not because you were measured.

• Session cookie (next-auth.session-token, or __Secure-next-auth.session-token over HTTPS) — keeps you signed in. Set when you sign in with Google, expires after 7 days, and is removed when you sign out.
• Staff session (ib_staff_session) — only ever set for Indexbrain staff signing in to the internal admin panel. It is never set on a customer account. HTTP-only, 7 days.

Analytics

We use two analytics tools to understand which parts of the product are used and where people get stuck.

• Google Analytics (_ga, _ga_*) — page views and traffic sources. Set by Google; see Google’s privacy policy.
• PostHog (ph_* cookies and local storage) — page views, page leaves, and session recordings. Recordings let us watch how a screen was actually used. All form inputs are masked, so what you type into a field is not captured. When you are signed in, PostHog is given your email address so activity can be tied to your account. See PostHog’s privacy policy.

Both load for every visitor at the moment. We do not yet show a consent banner, and we are working on one. If you would rather not be measured in the meantime, browser-level tracking protection or an ad blocker will stop both, and nothing about the product stops working when they are blocked.

Other browser storage

Some things are kept in your browser’s local storage rather than in a cookie. They never leave your device unless the feature says so.

• Space visitor id (ib_space_visitor) — a random id given to someone opening a published Space without signing in. It decides which rows that visitor is allowed to edit — their own — and identifies nobody.
• Interface preferences — small conveniences such as a remembered tab or a collapsed panel. Per browser, never sent to us.

What we do not do

• No advertising or cross-site tracking cookies.
• We do not sell your data, and we do not use it to train models.
• No cookies are used to read your connected tools. What Indexbrain can see in Slack, Gmail or your CRM is decided by the connection you authorised, never by anything in your browser.

Managing cookies

Every browser lets you see, block and delete cookies — usually under Settings, then Privacy. Blocking the session cookie will sign you out and keep you signed out; blocking the analytics ones changes nothing you can see.

Changes

When the cookies we use change, this page changes with them and the date at the top moves. Questions about anything here: privacy@indexbrain.online.