Cookies
- Version
- 2026-10-26
- Status
- Currently in effect (since October 26, 2026)
- Effective date
- 26 October 2026
- What changed
- The inventory is now complete and shows how long each item is kept. Added: the Google sign-in flow cookies (heading_oauth_consent, heading_oauth_country, next-auth.pkce.code_verifier, next-auth.state), the privacy-choices banner and policy-version items, the dismissal of the home-city offer, PostHog's tab and opt-out-marker items, and the Google and Stripe redirects. Corrected: error monitoring (Sentry) runs in your browser as well as on our servers (it sets no cookies or browser storage; session replay is off). No new processing or sharing of data was introduced; these items were already in use.
- Previous versions
- 2026-10-21 · 2026-09-04 · 2026-08-01 · 2026-07-12 · 2026-07-10 · All legal changes
HEADING sets a small number of cookies and browser-storage items to run the service and to understand product usage. Where the law requires your permission first, product analytics stays off until you agree; elsewhere (for example in the United States) it runs until you opt out. Either way you can change your choice at any time. This page lists every service we use, grouped by category, why it's there, and for how long.
Strictly necessary
Required to run HEADING — signing in, security, and remembering your cookie choice. These can't be switched off.
| Name | Provider | Duration | Purpose |
|---|---|---|---|
| Sign-in session (NextAuth.js) — Keeps you signed in and protects sign-in forms from cross-site request forgery. | |||
next-auth.session-token | HEADING | 30 days | Keeps you signed in (signed token, HttpOnly). |
next-auth.csrf-token | HEADING | Session (until you close your browser) | Protects the sign-in forms against cross-site request forgery. |
next-auth.callback-url | HEADING | Session (until you close your browser) | Returns you to the page you were on after signing in. |
next-auth.pkce.code_verifier | HEADING | 15 minutes | Google sign-in only: proves the sign-in response belongs to your request. |
next-auth.state | HEADING | 15 minutes | Google sign-in only: ties the sign-in response to your request. |
| Sign in with Google (Google) — If you choose "Continue with Google", you are sent to Google to sign in; Google sets its own cookies on its own site under its own policy. HEADING stores nothing for it on your device beyond the sign-in session. | |||
| No cookies or browser storage on HEADING | |||
| Sign-up confirmation for Google sign-in (HEADING) — Remembers, for ten minutes, the sign-up boxes you ticked and the country you chose while you are away at Google signing in, so your account is created with your agreement on record. | |||
heading_oauth_consent | HEADING | 10 minutes | Carries the box-ticks you made (terms, estimates, 18+) across the Google round trip. |
heading_oauth_country | HEADING | 10 minutes | Carries the country you chose across the Google round trip (only when you chose one). |
| Payment checkout (Stripe) — If you buy a report credit, you are sent to Stripe's hosted checkout; Stripe sets its own cookies on its own site under its own policy. HEADING stores nothing for it on your device. | |||
| No cookies or browser storage on HEADING | |||
| Consent preferences (HEADING) — Remembers your cookie/privacy choices so we don't ask again every visit, and proves your consent decision if asked. | |||
consent-kit:decision | HEADING | Until you clear your browser's site data | localStorage. Your cookie choices (legacy name heading-analytics-consent). |
consent-kit:subject | HEADING | Until you clear your browser's site data | localStorage. A random ID that ties your choices to their record (legacy name heading-anon-id). |
consent-kit:notice-dismissed | HEADING | Until you clear your browser's site data | localStorage. Remembers that you closed the privacy notice (legacy name heading-notice-at-collection-dismissed). |
consent-kit:opt-out-banner-dismissed | HEADING | Until you clear your browser's site data | localStorage. Remembers that you closed the privacy-choices banner. |
consent-kit:outbox-head | HEADING | Until you clear your browser's site data | localStorage. Bookkeeping for sending your choice to our consent record (legacy name heading-consent-last-sent). |
consent-kit:outbox | HEADING | Until you clear your browser's site data | localStorage. Holds a consent record until it is delivered. |
consent-kit:decision-epoch | HEADING | Until you clear your browser's site data | localStorage. Orders your choices if you change them more than once. |
heading-consent-policy-version | HEADING | Until you clear your browser's site data | localStorage. The privacy-policy version your choice was made under. |
heading-gpc-toast-seen | HEADING | Session (until you close the tab) | sessionStorage. Shows the 'we honoured your Global Privacy Control signal' note once per visit. |
heading-analytics-consent | HEADING | Until you clear your browser's site data | localStorage, legacy name of consent-kit:decision; replaced on your next visit. |
heading-anon-id | HEADING | Until you clear your browser's site data | localStorage, legacy name of consent-kit:subject; replaced on your next visit. |
heading-notice-at-collection-dismissed | HEADING | Until you clear your browser's site data | localStorage, legacy name of consent-kit:notice-dismissed; replaced on your next visit. |
heading-consent-last-sent | HEADING | Until you clear your browser's site data | localStorage, legacy name of consent-kit:outbox-head; replaced on your next visit. |
| Home-city offer dismissal (HEADING) — Remembers that you closed the "set as your home city" offer on a report, so we don't show it again for that report on this device. | |||
heading:home-city-offer-dismissed:<analysis id> | HEADING | Until you clear your browser's site data | localStorage. One entry per report whose 'set as your home city' offer you closed. |
| Error monitoring (Sentry) — Reports application errors, and a sample of page-load, navigation and request timings (a fraction of page loads in production), from your browser so we can fix bugs and keep HEADING fast. Reports are sent through HEADING's own /monitoring route to Sentry (EU). Sentry sets no cookies and no browser storage here, and session replay is off. | |||
| No cookies or browser storage on HEADING | |||
Performance
Helps us understand how HEADING is used so we can improve it — page views and feature usage, never sold or used for advertising.
| Name | Provider | Duration | Purpose |
|---|---|---|---|
| Product analytics (PostHog) — Privacy-friendly product analytics (PostHog, EU-hosted) — runs only while the Performance category is on: off until you grant it where the law requires permission first, on until you opt out elsewhere (for example in the United States). No analytics cookie is ever written. | |||
ph_* | PostHog | Until you clear your browser's site data or refuse / withdraw analytics | localStorage. PostHog's anonymous visitor ID and settings, plus a record of the first page and campaign you arrived from (same ph_ prefix). |
ph_<project key>_window_id | PostHog | Session (until you close the tab) | sessionStorage. Tells PostHog which browser tab events came from. |
ph_<project key>_primary_window_exists | PostHog | Session (until you close the tab) | sessionStorage. Tells PostHog whether another tab of HEADING is already open. |
__ph_opt_in_out_<project key> | PostHog | Until you clear your browser's site data | localStorage. Remembers your analytics choice (opted in or out) so PostHog respects it on your next visit. |
Manage your cookie choices anytime via the “Cookie settings” link in the footer, or in Settings if you’re signed in. See our Privacy policy for the full legal basis and sub-processor list.