On this page
Cookie Policy
This Cookie Policy explains how Trepeat uses cookies and similar browser-storage technologies on trepeat.com and app.trepeat.com. Our approach is intentionally minimal — strictly necessary cookies to operate the Service, plus privacy-friendly analytics that run only with your consent.
1. What Are Cookies?
Cookies are small text files placed on your device by websites you visit. They are widely used to make websites work, or work more efficiently, and to provide information to the site operator.
2. Cookies We Set
Strictly necessary cookies — the Service sets no first-party sign-in cookie. Your authenticated session (a short-lived JWT plus a refresh token) is held in your browser's localStorage / sessionStorage, not a cookie — see Browser Storage (§4) below. It is cleared on logout.
Analytics cookies — set only with your consent. If you accept analytics in the consent banner, our product-analytics provider PostHog (EU region, hosted in Frankfurt, Germany) sets first-party cookies to recognise your browser across pages and measure how the product is used. IP addresses are anonymised at ingest and session recording is disabled. Until you accept, none of these cookies are set and nothing is captured.
Under the GDPR ePrivacy regime, strictly necessary cookies do not require prior consent; analytics cookies do, which is why they are off until you opt in.
| Name | Type | Purpose | Retention |
|---|---|---|---|
| sb-<ref>-auth-token (and its -code-verifier) | localStorage (first-party, strictly necessary) | Keeps you signed in (Supabase session + refresh token); the code verifier secures a Google sign-in while it completes | Until logout |
| trepeat_cookie_consent | Cookie (first-party, strictly necessary) | Remembers your cookie-consent choice across trepeat.com and its subdomains, so you are asked once rather than on each subdomain and visit | 12 months / until cleared |
| trepeat:cookie-consent | localStorage (first-party, strictly necessary) | Same choice, kept alongside the cookie so it still applies if cookies are blocked and so a change in one tab takes effect in your others | Until cleared |
| Interface preferences (trepeat_*, tc-* and ec_* keys, e.g. trepeat_hide_account_ids, tc-repeater-expanded, tc-dismissed-notifs) | localStorage and sessionStorage (first-party, strictly necessary) | Remembers interface choices in the app — which notices and prompts you dismissed, expanded rows, whether account numbers are hidden — plus short-lived sign-in messages and a one-off page-reload marker. Never sent to our servers. | Until cleared (sessionStorage: until the tab closes) |
| trepeat_acq, trepeat_acq_sent | Cookie (first-party, analytics — consent-gated) | Remembers which campaign link or referring site first brought you here, so it can be attached once to your account if you sign up. A cookie rather than browser storage so the answer survives moving from the website to the app. Written only after you accept. | 12 months / until cleared |
| ph_<key>_posthog (and related) | Cookie and localStorage (first-party, analytics — consent-gated) | PostHog product analytics; set only after you accept | Up to 12 months |
| Stripe cookies | Cookie (third-party, set by Stripe.js, strictly necessary for payment) | Fraud prevention on pages with a payment form, which Stripe provides inside our pages | Set by Stripe — see Stripe's cookie policy (§6) |
3. Your Consent Choice
On your first visit you will see a consent banner with two choices — Accept or Reject. Analytics is disabled by default, so until you accept, no analytics cookie is set and no usage is captured. We also honour your browser's Do Not Track signal. You can change or withdraw your choice at any time — as easily as you gave it — via the Manage Cookies link in the site footer, or in the app under Settings → Manage cookie preferences. Your choice is remembered for up to 12 months or until you clear it. We also ask again whenever we add a non-essential cookie, so an earlier Accept never covers a cookie you were not told about. That is why you may have been asked again after the two acquisition cookies (trepeat_acq and trepeat_acq_sent, listed in §2) were added.
4. Browser Storage (Not Cookies)
We use localStorage and sessionStorage — browser-storage APIs distinct from cookies — to keep you signed in (your Supabase session token, sent as your authentication credential on requests to the Service and its backend), to remember your cookie-consent choice between visits, and to remember interface choices listed in §2. Your consent choice is not read or stored by our servers; none of this is shared with advertisers or data brokers.
5. What We Do Not Use
Even with analytics enabled, we do not use any of the following on trepeat.com or app.trepeat.com:
- Advertising or marketing cookies.
- Re-targeting pixels (Facebook, LinkedIn, Twitter, TikTok, etc.).
- Cross-site tracking, fingerprinting, or behavioural profiling.
- Third-party tag managers (Google Tag Manager, Segment, etc.).
- Selling or sharing your personal data with data brokers.
6. Third-Party Pages
Payment forms are provided by Stripe (Stripe.js) inside our pages, and Stripe may set its own fraud-prevention cookies, subject to its own policy. Managing billing opens Stripe's Customer Portal, a Stripe page with its own cookies. Refer to stripe.com/cookies-policy for details.
7. Managing Cookies
Withdraw or change your analytics consent at any time via the Manage Cookies link in the site footer (in the app: Settings → Manage cookie preferences). You can also clear or block cookies through your browser settings. Because your sign-in session lives in site storage (not a cookie), clearing or blocking localStorage / sessionStorage for app.trepeat.com will sign you out of the Service and also reset your interface preferences and consent choice (you will be asked again on the next visit).
8. Changes to This Policy
We may update this Policy from time to time. When we make a material change we will revise the “Last updated” date above and notify registered users by email before the change takes effect. Continued use of Trepeat after the effective date constitutes acceptance of the revised Policy. When we add a non-essential cookie, we list it on this page and ask for your choice again, including if you accepted before it was added. The new cookie is set only after you accept again, and you can withdraw that consent at any time.
9. Contact
For the full detail of who processes your data and how, see our Privacy Policy and Subprocessors list. Cookie questions: support@trepeat.com.