Cookie notice — version 2026-10-27b

Version: 2026-10-27b
Status: In effect from October 27, 2026 until November 1, 2026
Effective date: 27 October 2026
What changed: The inventory is now complete and shows how long each item is kept. Added: the Google sign-in flow cookies (heading_oauth_consent, heading_oauth_country, next-auth.pkce.code_verifier, next-auth.state), the privacy-choices banner and policy-version items, the dismissal of the home-city offer, PostHog's tab and opt-out-marker items, and the Google and Stripe redirects. Corrected: error monitoring (Sentry) runs in your browser as well as on our servers (it sets no cookies or browser storage; session replay is off). Sentry is now listed twice: "Error monitoring" (strictly necessary) and "Performance monitoring" (page-load and request timing and visit counts), which now runs only when the Performance category is on. No new processing or sharing of data was introduced; the performance items were already in use and now stop without your permission. Optional categories, product analytics included, now run only if you accept, in every country (the earlier wording that analytics runs until you opt out in the United States is replaced); each category description says so.
Other versions: 2026-11-01 (current) · 2026-10-27 · 2026-10-26 · 2026-10-21 · 2026-09-04 · 2026-08-01 · 2026-07-12 · 2026-07-10 · All legal changes

This is an archived, superseded version kept for reference. The current version is at /cookies.

HEADING sets a small number of cookies and browser-storage items to run the service and to understand product usage. Everything optional, product analytics included, runs only if you accept it, wherever you are; until you choose, and if you close the banner or your browser sends an opt-out signal, it stays off. You can change your choice at any time. This page lists every service we use, grouped by category, why it's there, and for how long.

Strictly necessary

Required to run HEADING — signing in, security, and remembering your cookie choice. These can't be switched off.

Name | Provider | Duration | Purpose

Sign-in session (NextAuth.js) — Keeps you signed in and protects sign-in forms from cross-site request forgery.

next-auth.session-token | HEADING | 30 days | Keeps you signed in (signed token, HttpOnly).

next-auth.csrf-token | HEADING | Session (until you close your browser) | Protects the sign-in forms against cross-site request forgery.

next-auth.callback-url | HEADING | Session (until you close your browser) | Returns you to the page you were on after signing in.

next-auth.pkce.code_verifier | HEADING | 15 minutes | Google sign-in only: proves the sign-in response belongs to your request.

next-auth.state | HEADING | 15 minutes | Google sign-in only: ties the sign-in response to your request.

Sign in with Google (Google) — If you choose "Continue with Google", you are sent to Google to sign in; Google sets its own cookies on its own site under its own policy. HEADING stores nothing for it on your device beyond the sign-in session.

No cookies or browser storage on HEADING

Sign-up confirmation for Google sign-in (HEADING) — Remembers, for ten minutes, the sign-up boxes you ticked and the country you chose while you are away at Google signing in, so your account is created with your agreement on record.

heading_oauth_consent | HEADING | 10 minutes | Carries the box-ticks you made (terms, estimates, 18+) across the Google round trip.

heading_oauth_country | HEADING | 10 minutes | Carries the country you chose across the Google round trip (only when you chose one).

Payment checkout (Stripe) — If you buy a report credit, you are sent to Stripe's hosted checkout; Stripe sets its own cookies on its own site under its own policy. HEADING stores nothing for it on your device.

No cookies or browser storage on HEADING

Consent preferences (HEADING) — Remembers your cookie/privacy choices so we don't ask again every visit, and proves your consent decision if asked.

consent-kit:decision | HEADING | Until you clear your browser's site data | localStorage. Your cookie choices (legacy name heading-analytics-consent).

consent-kit:subject | HEADING | Until you clear your browser's site data | localStorage. A random ID that ties your choices to their record (legacy name heading-anon-id).

consent-kit:notice-dismissed | HEADING | Until you clear your browser's site data | localStorage. Remembers that you closed the privacy notice (legacy name heading-notice-at-collection-dismissed).

consent-kit:opt-out-banner-dismissed | HEADING | Until you clear your browser's site data | localStorage. Remembers that you closed the privacy-choices banner.

consent-kit:outbox-head | HEADING | Until you clear your browser's site data | localStorage. Bookkeeping for sending your choice to our consent record (legacy name heading-consent-last-sent).

consent-kit:outbox | HEADING | Until you clear your browser's site data | localStorage. Holds a consent record until it is delivered.

consent-kit:decision-epoch | HEADING | Until you clear your browser's site data | localStorage. Orders your choices if you change them more than once.

heading-consent-policy-version | HEADING | Until you clear your browser's site data | localStorage. The privacy-policy version your choice was made under.

heading-gpc-toast-seen | HEADING | Session (until you close the tab) | sessionStorage. Shows the 'we honoured your Global Privacy Control signal' note once per visit.

heading-analytics-consent | HEADING | Until you clear your browser's site data | localStorage, legacy name of consent-kit:decision; replaced on your next visit.

heading-anon-id | HEADING | Until you clear your browser's site data | localStorage, legacy name of consent-kit:subject; replaced on your next visit.

heading-notice-at-collection-dismissed | HEADING | Until you clear your browser's site data | localStorage, legacy name of consent-kit:notice-dismissed; replaced on your next visit.

heading-consent-last-sent | HEADING | Until you clear your browser's site data | localStorage, legacy name of consent-kit:outbox-head; replaced on your next visit.

Home-city offer dismissal (HEADING) — Remembers that you closed the "set as your home city" offer on a report, so we don't show it again for that report on this device.

heading:home-city-offer-dismissed:<analysis id> | HEADING | Until you clear your browser's site data | localStorage. One entry per report whose 'set as your home city' offer you closed.

Error monitoring (Sentry) — When something breaks, sends an error report to Sentry (EU) so we can fix it: the error message and technical trace, the page address without anything after a "?", your browser and device type, and a short trail of recent page changes and clicks. Cookies, sign-in headers and console text are removed before it leaves, and your IP address is not passed on. Sentry sets no cookies and no browser storage here, and session replay is off.

No cookies or browser storage on HEADING

Performance

Helps us understand how HEADING is used so we can improve it — page views and feature usage, never sold or used for advertising. Runs only if you accept.

Name | Provider | Duration | Purpose

Performance monitoring (Sentry) — Measures page-load, navigation and request timings, including Core Web Vitals, on visits after you accept, for a fraction of visits (one in ten in production), and counts each visit as a session so we can tell whether a release is stable. Runs only while the Performance category is on. Sends through HEADING's own /monitoring route to Sentry (EU), sets no cookies and no browser storage.

No cookies or browser storage on HEADING

Product analytics (PostHog) — Privacy-friendly product analytics (PostHog, EU-hosted) — runs only if you accept: it stays off until you turn the Performance category on, in every country, and stops when you turn it off. No analytics cookie is ever written.

ph_* | PostHog | Until you clear your browser's site data or refuse / withdraw analytics | localStorage. PostHog's anonymous visitor ID and settings, plus a record of the first page and campaign you arrived from (same ph_ prefix).

ph_<project key>_window_id | PostHog | Session (until you close the tab) | sessionStorage. Tells PostHog which browser tab events came from.

ph_<project key>_primary_window_exists | PostHog | Session (until you close the tab) | sessionStorage. Tells PostHog whether another tab of HEADING is already open.

__ph_opt_in_out_<project key> | PostHog | Until you clear your browser's site data | localStorage. Remembers your analytics choice (opted in or out) so PostHog respects it on your next visit.

Manage your cookie choices anytime via the “Cookie settings” link in the footer, or in Settings [/settings] if you’re signed in. See our Privacy policy [/privacy] for the full legal basis and sub-processor list.