COOKIE POLICY
Last updated October 4, 2026
CheckInOS uses strictly necessary cookies to authenticate users and secure the Services. We do not require a cookie consent banner for those authentication cookies where they qualify as strictly necessary under applicable ePrivacy rules. We use PostHog (EU Cloud) for privacy-focused event and page-view analytics, but only after you affirmatively accept analytics cookies in our cookie consent banner. See MANAGING PREFERENCES below. Nothing from PostHog loads, and no PostHog cookie or browser storage is set, until you accept.
TABLE OF CONTENTS
1. WHAT COOKIES ARE
Cookies are small text files stored on your device. We also use browser storage (such as localStorage) for certain in-app preferences.
2. LEGAL FRAMEWORK
Strictly necessary cookies (including authentication session and CSRF cookies) may be used without consent where legally exempt.
For personal data processed through these technologies, we rely on GDPR/UK GDPR bases including contract necessity, legitimate interests (where appropriate), and legal obligations. See our Privacy Policy.
3. COOKIE AND STORAGE TABLE
| Category | Provider | Identifiers | Purpose | Consent | Retention |
|---|---|---|---|---|---|
| Strictly necessary (authentication) | Auth.js / NextAuth | Session token, CSRF token, callback URL cookies (names may include __Secure- or __Host- prefixes) | Sign-in, session security, CSRF protection, OAuth redirects | Not required where strictly necessary; no separate banner required for these cookies alone | Session / configured expiry |
| Local storage (non-cookie) | CheckInOS app | attendee-filters-${eventId}, resetOnboarding | Saved filter preferences and onboarding UI state | Functional preference storage for logged-in users; not used for cross-site advertising | Until cleared by user or app |
| Analytics (opt-in) | PostHog (EU Cloud) | ph_<project_api_key>_posthog (cookie and/or localStorage, PostHog's default persistence) | Page-view and product usage event analytics only — no session replay, no heatmaps | Required — only set after you accept analytics cookies in the cookie consent banner or preferences | Up to 1 year, or immediately cleared on decline/withdrawal |
4. THIRD PARTIES
Identity providers (Google, Microsoft, Apple) may set their own cookies during OAuth sign-in. See our Subprocessor List and provider privacy notices.
Analytics (PostHog, EU Cloud). With your consent, we use PostHog to record page views and product usage events so we can understand how CheckInOS is used and improve it. PostHog is hosted on PostHog's EU Cloud infrastructure. We only capture events and page views. We do not use session replay, heatmaps, or any other PostHog feature. PostHog is loaded and its cookie/localStorage identifier is only set after you click "Accept" in the cookie consent banner or in your cookie preferences; if you decline or have not yet decided, no PostHog script, cookie, or request occurs. See the table above for the exact identifier PostHog sets.
Bot protection (Cloudflare Turnstile). Our public forms (contact, support, data deletion, and free-resource requests) load Cloudflare Turnstile to tell people from automated traffic. It does not set cookies for this purpose. It reads browser and device signals, which is strictly necessary to keep those forms secure, so it runs without analytics consent and is not affected by your cookie choice. Cloudflare receives your IP address while it checks your browser.
We do not use Vercel Analytics, advertising cookies, or retargeting cookies on the Services.
5. MANAGING PREFERENCES
- Use the "Cookie preferences" link in the site footer (or in Settings when signed in) to change your analytics cookie choice at any time. Accepting turns PostHog on, declining turns it off and clears its identifier.
- Block or delete cookies in your browser settings.
- Clear site data and
localStoragefor checkinos.com. - Log out to end your session.
Blocking strictly necessary cookies will prevent sign-in. Declining or withdrawing analytics consent only stops PostHog. It never affects sign-in or core functionality.