1. What counts as browser storage
Cookies are small values stored by your browser and sent with matching requests. Local storage and session storage stay in the browser and are not automatically attached to requests. This policy covers all three because their practical effect matters more than the label.
2. Storage Pubtact currently uses
| Name | Type and duration | Purpose |
|---|---|---|
access_token | HTTP-only cookie · 15 minutes | Authenticates your account for API requests. Short-lived by design; renewed automatically in the background while you're signed in. In production it is restricted to secure requests. |
refresh_token | HTTP-only cookie · up to 30 days, sent only to sign-in endpoints | Lets your session renew itself for up to 30 days without re-entering your password. Single-use and rotated on every renewal. |
pubtact_token | Session storage · current browser tab | Provides a tab-scoped authentication fallback when a browser drops a session cookie during sign-in redirects. |
pubtact_analytics_visitor_id_v1 | Cookie and local storage · up to 1 year | Assigns a pseudonymous visitor identifier so public-page owners can see unique-view and interaction counts. |
pubtact:analytics:session_id:v1 | Session storage · current browser tab | Groups public-page activity into a browser session and prevents duplicate page-view events. |
pubtact:lang | Local storage · until cleared | Remembers the language selected in the dashboard. |
pubtact:runtime-recovery-at | Session storage · current browser tab | Prevents repeated reload loops while recovering from stale application files. |
_ga, _ga_* | Cookie · up to 2 years, set on pubtact.com only | Set by Google Analytics to assign a pseudonymous identifier and group visits into sessions, so we can see how many people reach the site and which pages they use. |
ph_*_posthog | Cookie and local storage · up to 1 year, set on pubtact.com only | Set by PostHog to assign a pseudonymous identifier and group activity into sessions, so we can see which product steps people complete and where they stop. Linked to your account identifier while you are signed in, and cleared when you sign out. |
3. Public-page analytics
Public pages use a pseudonymous visitor identifier and session identifier to count views and interactions for the page owner. Analytics events can include page path, source URL, campaign parameters, browser language, timezone, viewport, and the action taken. The identifier is not intended to identify a person by name.
4. Site measurement
Pubtact uses Google Analytics on pubtact.com to measure its own traffic: which pages are reached, from where, and how visitors move between them. It records page paths, referrer, campaign parameters, and coarse device and location context, and it sets the _ga cookies listed above. It is not used to build advertising profiles, and it does not run on staging or development builds.
Pubtact also uses PostHog on pubtact.com to measure how the product itself is used: which steps of creating and publishing a page get completed, and where people stop. It records page paths, referrer, campaign parameters, coarse device and location context, and named product events such as publishing a page or starting a checkout. While you are signed in these are linked to your account identifier so a single journey can be followed end to end; your email address and name are not sent to PostHog. Signing out unlinks the identifier. Like Google Analytics, it is not used to build advertising profiles and does not run on staging or development builds.
PostHog also records a replay of the session — the pages visited and where you clicked, scrolled and typed — and captures errors the site throws, so a fault can be seen as it happened rather than guessed at from a stack trace. What you type is never captured: the contents of every text box, password field and dropdown are replaced with asterisks before the recording leaves your browser, and no network request headers or bodies are recorded. Text already displayed on the page is captured, including the preview of a page you are building. Replays are retained by PostHog and expire on its standard schedule.
5. Third-party storage
Third parties may set or read their own storage only when you invoke their service—for example, opening Razorpay checkout or choosing a social sign-in provider. Their privacy and cookie policies govern that storage. Apart from the Google Analytics and PostHog measurement described above, Pubtact does not embed third-party advertising trackers on its marketing pages.
6. Your controls
You can clear or block cookies and site data in browser settings. Blocking the session cookie and session-storage fallback can prevent sign-in from working. Clearing the analytics identifier causes a future public-page visit to be counted under a new pseudonymous identifier.
Browser “do not track” signals are not a universal consent mechanism and Pubtact does not currently make a separate promise about them. We will update this policy if consent controls or analytics behavior changes.
7. Questions
For browser-storage or analytics questions, email hello@pubtact.com. See the Privacy Policy for broader information about data use.