Cookie notice — version 2026-10-21
- Version
- 2026-10-21
- Status
- In effect from October 21, 2026 until October 26, 2026
- Effective date
- 21 October 2026
- What changed
- Wording corrected to match what the product does: product analytics is off until you agree where the law requires your permission first, and on until you opt out elsewhere (for example in the United States). No cookie or storage item was added or changed.
- Previous versions
- 2026-10-26 · 2026-09-04 · 2026-08-01 · 2026-07-12 · 2026-07-10 · All legal changes
This is an archived, superseded version kept for reference. The current version is at /cookies.
Cookies
HEADING sets a small number of cookies and browser-storage items to run the service and to understand product usage. Where the law requires your permission first, product analytics stays off until you agree; elsewhere (for example in the United States) it runs until you opt out. Either way you can change your choice at any time. This page lists every service we use, grouped by category, why it's there, and for how long.
Strictly necessary
Required to run HEADING — signing in, security, and remembering your cookie choice. These can't be switched off.
Name | Provider | Purpose
next-auth.session-tokennext-auth.csrf-tokennext-auth.callback-url | NextAuth.js | Keeps you signed in and protects sign-in forms from cross-site request forgery.
consent-kit:decisionconsent-kit:subjectconsent-kit:notice-dismissedconsent-kit:outbox-headconsent-kit:outboxconsent-kit:decision-epochheading-analytics-consentheading-anon-idheading-notice-at-collection-dismissedheading-consent-last-sentheading-gpc-toast-seen | HEADING | Remembers your cookie/privacy choices so we don't ask again every visit, and proves your consent decision if asked.
No client-side storage | Sentry | Reports application errors so we can fix bugs — runs server-side only, sets no cookies or browser storage.
Performance
Helps us understand how HEADING is used so we can improve it — page views and feature usage, never sold or used for advertising.
Name | Provider | Purpose
ph_* | PostHog | Privacy-friendly product analytics (PostHog, EU-hosted) — runs only while the Performance category is on: off until you grant it where the law requires permission first, on until you opt out elsewhere (for example in the United States). No analytics cookie is ever written.
Manage your cookie choices anytime via the “Cookie settings” link in the footer, or in Settings [/settings] if you’re signed in. See our Privacy policy [/privacy] for the full legal basis and sub-processor list.