Cookie & Telemetry Policy
Version 1.1.1 — content locked 7 August 2026.
In plain words. Prelog uses a very small set of cookies. Two are strictly necessary and cannot be turned off. Two more support product analytics and payments; those need your consent before we set them, and you can change your mind at any time via in the footer.
We do not run advertising cookies. We do not sell your data. We do not use cross-site retargeting.
For the full legal picture, see the Privacy Policy.
1. What is a cookie (and adjacent technologies)
A "cookie" is a small text file a site places on your device. This policy also covers similar technologies — local storage, session storage, and pixel-like beacons — because EU/EEA law treats them the same for consent purposes (ePrivacy Directive Art. 5(3) as implemented in Norway via ekomloven / GDPR consent standard (EEA Agreement)).
2. Categories we use
Prelog groups cookies into two consent categories. There is no third category. There are no advertising or "personalisation" cookies.
2.1 Strictly necessary (always on — no consent required)
These make the site work. Refusing them would break the product.
| Cookie / storage key | Purpose | Set by | Lifetime |
|---|---|---|---|
prelog_session | Keeps you signed in after login. HttpOnly, Secure, SameSite=Lax. | Prelog | 30 days rolling |
prelog_csrf | Cross-Site Request Forgery protection on forms and POST endpoints. | Prelog | Session |
localStorage: prelog.theme | Remembers dark/light preference. No personal data. | Prelog | Until cleared |
2.2 Optional — consent required
Turned off by default. Set only if you click "Accept all" or turn the specific category on in Cookie settings.
| Cookie / storage key | Purpose | Set by | Lifetime | Category |
|---|---|---|---|---|
ph_<projectkey>_posthog | Product analytics — distinct id + session id. Proxied via prelog.app/ingest. | PostHog Inc. (EU cloud) | 12 months | Analytics |
ph_<projectkey>_session_recording | Session replay for debugging (masked for password fields, chat text, and body-weight numbers). Only set if replay is enabled. | PostHog Inc. | Session | Analytics |
__stripe_mid | Stripe fraud prevention on Checkout. Set only on /checkout or Customer Portal pages. | Stripe Payments Europe, Ltd. | 1 year | Payments |
__stripe_sid | Stripe session for Checkout / Customer Portal. | Stripe | 30 minutes | Payments |
Session replay content is minimised: password fields, weight logs, and free-text chat are masked before being sent to PostHog. See Privacy Policy §2.
3. How consent works
- On your first visit we show a consent banner at the bottom of the screen.
- Three buttons: "Only necessary", "Manage settings", "Accept all". All three are equally prominent — no "Accept" button larger or brighter than "Reject", per EDPB Guidelines 03/2022 on deceptive patterns.
- Until you choose, we set only the strictly-necessary cookies listed in §2.1.
- Your choice is stored in localStorage as
prelog.consent = {analytics, payments, ts, ver}. It persists for 12 months, then we re-ask. - You can change your choice at any time via in the site footer. Withdrawing consent removes the affected cookies on next page load.
- The banner is not dismissable by clicking outside it, and there is no "auto-accept on scroll".
4. Third parties and international transfers
Analytics and payments cookies involve processing by the parties named in §2.2. Data-transfer mechanisms are described in the Privacy Policy §4. PostHog is configured to the EU cloud where available. Stripe processes payments in the EU with limited US transfers under SCCs.
5. Do Not Track and Global Privacy Control
We honour the Global Privacy
Control header. If your browser sends Sec-GPC: 1, we treat that as a
refusal of consent for the optional categories and do not show the banner unless you
explicitly open Cookie settings. We do not act on the older Do-Not-Track header because it
has been widely retired.
6. Changes to this policy
Material changes (new cookie categories, new sub-processors, expanded lifetimes) are announced on the site and, for subscribers, by email. The current version is at the top of this page.
7. Questions
Email [email protected]. Prelog is operated by Agdir Drift AS
(Norway); registered office [Norwegian registered office — awaiting CEO input];
organisasjonsnummer [Norwegian organisasjonsnummer — awaiting CEO input]
(Foretaksregisteret, Brønnøysundregistrene); Norwegian MVA number
[MVA number — awaiting registration]. You may also lodge a complaint
with the Norwegian Data Protection Authority, Datatilsynet
(datatilsynet.no), or with the
supervisory authority in your EEA country of residence.
- v1.1.1 (2026-08-07) — version bump only for cross-doc alignment with the PRE-210 T&Cs §2 + Privacy §11 duty-of-care disclosure fixes. Cookie inventory, consent categories, sub-processor list, and ePrivacy basis unchanged. Not lawyer-reviewed.
- v1.1.0 (2026-08-07) — entity anchor flipped from Prelog OÜ (Estonia) to Agdir Drift AS (Norway) per PRE-31 board decision f3951aff (PRE-205). Supervisory authority → Datatilsynet; national personal-data law → personopplysningsloven; ePrivacy Art. 5(3) implementation → Norwegian ekomloven (GDPR consent standard preserved via EEA Agreement). Cookie inventory and consent categories unchanged. Organisasjonsnummer, registered address, and MVA number remain [TBD] pending CEO input; will patch on receipt.
- v1.0.0 (2026-08-02) — editorial content locked for lawyer review under PRE-131. Banner + consent flow live in production per PRE-126.
- v0.1 (2026-08-02) — initial draft under PRE-118.