Cookie Policy
Last updated: 28 September 2026
Aalto uses a small number of cookies and local storage keys. Some are strictly necessary for the Service to work. Others are analytics cookies, which we only set if you allow them. We do not use advertising cookies.
Strictly necessary cookies
| Name | Purpose | Duration |
|---|---|---|
sb-<project-ref>-auth-token | Supabase authentication session. Required to keep you signed in and to sync sessions with the browser extensions. | 30 days, refreshed on activity |
sb-<project-ref>-auth-token-code-verifier | Short-lived OAuth PKCE verifier used during sign-in. | Minutes |
Referral cookie
If you arrive through a link on someone's public Aalto page (a link containing ?ref=), we set aalto_ref with that person's public handle for 30 days. If you sign up, it tells us who referred you. It holds nothing about you and is deleted once your sign-up is complete.
Analytics cookies (only with your consent)
When you first visit, we ask whether you allow analytics cookies. Until you accept, none of the cookies below are set. They help us understand which pages and features people use so we can improve Aalto. We don't use them for advertising.
| Name | Provider and purpose | Duration |
|---|---|---|
_ga | Google Analytics 4. Tells visits from the same browser apart using a random ID. | 2 years |
_ga_8JZB18TL1F | Google Analytics 4. Keeps track of the current session. | 2 years |
ph_<project-key>_posthog | PostHog product analytics. Stores a random ID and session details so we can see how features are used. PostHog also keeps a copy in local storage. | 1 year |
If you accept, PostHog may also record how you move through a page (clicks, scrolling and page changes) so we can find confusing or broken parts of Aalto. These recordings hide all text, form inputs, images and video, so they show the layout of the page but not its content. They are kept for 30 days.
If you reject analytics cookies, PostHog may still count page views without setting cookies or storing anything on your device, using a short-lived anonymous hash created on PostHog's servers.
Cookie-free measurement
Vercel Web Analytics and Cloudflare Web Analytics count page views in aggregate and set no cookies. Sentry, our error monitoring service, uses session storage to hold a short recording of the page in your browser. It is sent to us only if an error happens, and text, form inputs and images are masked before it leaves your device.
Local storage
We store UI preferences (view mode per collection, column layouts, collapsed state) in your browser's local storage so the app remembers how you had it last. This never leaves your device. We also store your analytics cookie choice (aalto:analytics-consent) so we don't ask again on every visit. PostHog keeps its own record of that choice too.
Third parties
Checkout pages are hosted by Stripe, which sets its own cookies for fraud prevention. See Stripe's cookie policy for details.
Your choices
If you withdraw consent, we stop analytics tracking and delete the Google Analytics cookies from this site. You can also clear cookies and local storage at any time using your browser settings. Doing so will sign you out and reset your UI preferences.