Legal
Cookie policy
Our cookie philosophy
We minimise the use of cookies and trackers to provide the best possible experience with the least possible friction. Our setup (PostHog EU in cookieless mode + a single httpOnly session cookie) qualifies for the CNIL audience measurement exemption, so no blocking consent banner is required at MVP.
Cookies & trackers in use
| Name / Tool | Type | Purpose | Consent required? | Duration |
|---|---|---|---|---|
better-auth.session_token | Strictly necessary | Authenticates your session in the panel. httpOnly, SameSite=Lax. Cannot be disabled. The site cannot function without it. | No (CNIL exempt) | 30 days (sliding) |
| PostHog (cookieless) | Audience analytics | Measures site navigation (conversion funnel, page views) in an aggregated, non-identifying way. EU Cloud (Frankfurt). No cross-site tracking. No advertising purpose. | No (CNIL audience measurement exemption, cookieless + limited purpose) | Session / aggregated ≤ 12 months |
| Language preference | Functional | Stores your chosen language (FR/EN) in localStorage. Not a cookie. | No | Persistent (localStorage) |
| Stripe (checkout page) | Third-party (Stripe domain) | Stripe's checkout page uses its own cookies for fraud prevention and payment processing. These are on Stripe's domain, not ours. See Stripe's cookie policy. | Managed by Stripe on their domain | Per Stripe policy |
Session replay
PostHog's session replay feature is OFF by default. If activated in future for targeted UX debugging, a consent banner will be displayed first, as session replay exits the CNIL audience measurement exemption.
Future changes
If we add cookies or trackers that require consent (e.g. session replay, advertising), we will display a banner with equal Accept / Decline buttons, no dark patterns, and a link to this page.
Questions
privacy@questfable.app, or see our full Privacy policy.