Cookies
- Version
- 2026-11-01
- Status
- Currently in effect (since November 1, 2026)
- Effective date
- 1 November 2026
- What changed
- The page now says how long your cookie choice stands: it is kept for 12 months and then we ask you again (the earlier period was 180 days). The note that confirms we honoured your Global Privacy Control signal is now shown once for each cookie choice, and the page says where that is remembered. The inventory of cookies and browser storage is unchanged; no new processing or sharing of data was introduced.
- Previous versions
- 2026-10-27b · 2026-10-27 · 2026-10-26 · 2026-10-21 · 2026-09-04 · 2026-08-01 · 2026-07-12 · 2026-07-10 · All legal changes
HEADING sets a small number of cookies and browser-storage items to run the service and to understand product usage. Everything optional, product analytics included, runs only if you accept it, wherever you are; until you choose, and if you close the banner or your browser sends an opt-out signal, it stays off. You can change your choice at any time. Your choice is kept for 12 months; after that we ask you again. This page lists every service we use, grouped by category, why it's there, and for how long.
Strictly necessary
Required to run HEADING — signing in, security, and remembering your cookie choice. These can't be switched off.
| Name | Provider | Duration | Purpose |
|---|---|---|---|
| Sign-in session (NextAuth.js) — Keeps you signed in and protects sign-in forms from cross-site request forgery. | |||
next-auth.session-token | HEADING | 30 days | Keeps you signed in (signed token, HttpOnly). |
next-auth.csrf-token | HEADING | Session (until you close your browser) | Protects the sign-in forms against cross-site request forgery. |
next-auth.callback-url | HEADING | Session (until you close your browser) | Returns you to the page you were on after signing in. |
next-auth.pkce.code_verifier | HEADING | 15 minutes | Google sign-in only: proves the sign-in response belongs to your request. |
next-auth.state | HEADING | 15 minutes | Google sign-in only: ties the sign-in response to your request. |
| Sign in with Google (Google) — If you choose "Continue with Google", you are sent to Google to sign in; Google sets its own cookies on its own site under its own policy. HEADING stores nothing for it on your device beyond the sign-in session. | |||
| No cookies or browser storage on HEADING | |||
| Sign-up confirmation for Google sign-in (HEADING) — Remembers, for ten minutes, the sign-up boxes you ticked and the country you chose while you are away at Google signing in, so your account is created with your agreement on record. | |||
heading_oauth_consent | HEADING | 10 minutes | Carries the box-ticks you made (terms, estimates, 18+) across the Google round trip. |
heading_oauth_country | HEADING | 10 minutes | Carries the country you chose across the Google round trip (only when you chose one). |
| Payment checkout (Stripe) — If you buy a report credit, you are sent to Stripe's hosted checkout; Stripe sets its own cookies on its own site under its own policy. HEADING stores nothing for it on your device. | |||
| No cookies or browser storage on HEADING | |||
| Consent preferences (HEADING) — Remembers your cookie/privacy choices so we don't ask again every visit, and proves your consent decision if asked. | |||
consent-kit:decision | HEADING | Until you clear your browser's site data | localStorage. Your cookie choices, kept for 12 months and then asked again (legacy name heading-analytics-consent). |
consent-kit:subject | HEADING | Until you clear your browser's site data | localStorage. A random ID that ties your choices to their record (legacy name heading-anon-id). |
consent-kit:notice-dismissed | HEADING | Until you clear your browser's site data | localStorage. Remembers that you closed the privacy notice (legacy name heading-notice-at-collection-dismissed). |
consent-kit:opt-out-banner-dismissed | HEADING | Until you clear your browser's site data | localStorage. Remembers that you closed the privacy-choices banner. |
consent-kit:outbox-head | HEADING | Until you clear your browser's site data | localStorage. Bookkeeping for sending your choice to our consent record (legacy name heading-consent-last-sent). |
consent-kit:outbox | HEADING | Until you clear your browser's site data | localStorage. Holds a consent record until it is delivered. |
consent-kit:decision-epoch | HEADING | Until you clear your browser's site data | localStorage. Orders your choices if you change them more than once. |
heading-consent-policy-version | HEADING | Until you clear your browser's site data | localStorage. The privacy-policy version your choice was made under. |
heading-gpc-toast-seen | HEADING | Until you clear your browser's site data | localStorage (sessionStorage if your browser blocks localStorage). Remembers which cookie choice the 'we honoured your Global Privacy Control signal' note was last shown for, so it is shown once for each choice, not on every visit. |
heading-analytics-consent | HEADING | Until you clear your browser's site data | localStorage, legacy name of consent-kit:decision; replaced on your next visit. |
heading-anon-id | HEADING | Until you clear your browser's site data | localStorage, legacy name of consent-kit:subject; replaced on your next visit. |
heading-notice-at-collection-dismissed | HEADING | Until you clear your browser's site data | localStorage, legacy name of consent-kit:notice-dismissed; replaced on your next visit. |
heading-consent-last-sent | HEADING | Until you clear your browser's site data | localStorage, legacy name of consent-kit:outbox-head; replaced on your next visit. |
| Home-city offer dismissal (HEADING) — Remembers that you closed the "set as your home city" offer on a report, so we don't show it again for that report on this device. | |||
heading:home-city-offer-dismissed:<analysis id> | HEADING | Until you clear your browser's site data | localStorage. One entry per report whose 'set as your home city' offer you closed. |
| Error monitoring (Sentry) — When something breaks, sends an error report to Sentry (EU) so we can fix it: the error message and technical trace, the page address without anything after a "?", your browser and device type, and a short trail of recent page changes and clicks. Cookies, sign-in headers and console text are removed before it leaves, and your IP address is not passed on. Sentry sets no cookies and no browser storage here, and session replay is off. | |||
| No cookies or browser storage on HEADING | |||
Performance
Helps us understand how HEADING is used so we can improve it — page views and feature usage, never sold or used for advertising. Runs only if you accept.
| Name | Provider | Duration | Purpose |
|---|---|---|---|
| Performance monitoring (Sentry) — Measures page-load, navigation and request timings, including Core Web Vitals, on visits after you accept, for a fraction of visits (one in ten in production), and counts each visit as a session so we can tell whether a release is stable. Runs only while the Performance category is on. Sends through HEADING's own /monitoring route to Sentry (EU), sets no cookies and no browser storage. | |||
| No cookies or browser storage on HEADING | |||
| Product analytics (PostHog) — Privacy-friendly product analytics (PostHog, EU-hosted) — runs only if you accept: it stays off until you turn the Performance category on, in every country, and stops when you turn it off. No analytics cookie is ever written. | |||
ph_* | PostHog | Until you clear your browser's site data or refuse / withdraw analytics | localStorage. PostHog's anonymous visitor ID and settings, plus a record of the first page and campaign you arrived from (same ph_ prefix). |
ph_<project key>_window_id | PostHog | Session (until you close the tab) | sessionStorage. Tells PostHog which browser tab events came from. |
ph_<project key>_primary_window_exists | PostHog | Session (until you close the tab) | sessionStorage. Tells PostHog whether another tab of HEADING is already open. |
__ph_opt_in_out_<project key> | PostHog | Until you clear your browser's site data | localStorage. Remembers your analytics choice (opted in or out) so PostHog respects it on your next visit. |
Manage your cookie choices anytime via the “Cookie settings” link in the footer, or in Settings if you’re signed in. See our Privacy policy for the full legal basis and sub-processor list.