Last updated: 2026-09-11
The short version
- Strictly-necessary and authentication cookies are set so the site and sign-in work. They carry no analytics.
- All product-analytics trackers (PostHog, Google Analytics, Vercel Web Analytics, and Sentry Session Replay) load only after you accept them in the cookie banner.
- One thing does run before you choose: the Sentry error reporter loads with every page so a crash gets reported, and in production it also times one navigation in ten. It sets no cookie and records no session. The session recording (Sentry Session Replay) still waits for your consent.
- “Reject all” is one click and keeps every analytics tracker off. It is the same number of clicks as accepting.
- The free localhost desktop app sets no analytics or tracking cookies. The only cookie it can set is a session cookie during optional interactive sign-in. It does send an anonymous reliability beacon by default, keyed to a per-install ID held on your machine, and you can switch it off in the app (see section 1.1 of the Privacy Policy). This policy covers the repoops.ai website.
1. What cookies are
A cookie is a small file a website stores in your browser. We also use a browser storage key (localStorage) to remember your cookie choice so the banner does not reappear once you have decided. We group what we set into three categories.
2. Strictly-necessary cookies
These are required for the site to function and are exempt from consent under GDPR and PECR. They are set whether or not you accept analytics.
| Cookie / key | Purpose |
|---|---|
| Session cookie | Keeps you signed in across page loads. |
| CSRF token | Protects form and billing actions from cross-site request forgery. |
| Sign-in state and return path | Protects the sign-in round trip and returns you to the page you started from. |
repoops.cookie-consent (localStorage) | Records your accept / reject choice so the banner does not reappear. |
3. Authentication cookies
After you sign in, RepoOps and our authentication library (Auth.js / NextAuth) set session and sign-in cookies. These are exempt from consent because you explicitly authenticated to use hosted features. They are not set for anonymous visitors.
4. Product-analytics cookies (consent-gated)
None of the following load until you click “Accept analytics” in the cookie banner. If you click “Reject all,” or ignore the banner, none of them run.
| Tracker | Purpose | Provider |
|---|---|---|
| PostHog | Product analytics: page views, button clicks, anonymous session IDs. | PostHog |
| Google Analytics | Aggregate web analytics, loaded only after consent. | |
| Vercel Web Analytics | Privacy-friendly page-view counts for the marketing site. | Vercel |
| Sentry Session Replay | A masked recording of your own session for debugging, with text and inputs masked by default. | Sentry |
5. What “Reject all” does
Clicking “Reject all” records a rejected choice and keeps every tracker in the table above switched off. Only the strictly-necessary and authentication cookies remain. Your choice is stored in your browser; to change it, clear the repoops.cookie-consent key in your browser storage and reload, and the banner will reappear.
6. Managing cookies in your browser
You can also block or delete cookies through your browser settings. If you block strictly-necessary cookies, sign-in and billing will not work correctly.
See also: Privacy Policy · Sub-processors · Legal center.