Cookie Policy

Last updated: 2026-07-30

Short version: a few cookies are required to sign you in and to remember your choice here. One cookie is optional — an analytics cookie that lets us count returning visitors. It is off until you turn it on, and you can change your mind at any time.

We don't run advertising cookies, cross-site trackers, or session recording. Nothing here is sold or shared with data brokers.

Strictly necessary — no consent needed

These are exempt from consent under EU ePrivacy Directive Article 5(3): you can't run an authenticated app without them, and remembering a "no" is the only way to honour it. They carry no advertising or profiling value.

fixaeo_session30 days, rolling

Keeps you signed in across page loads. Without it the app forgets you after every navigation.

HttpOnly · SameSite=Lax · Secure · scoped to .fixaeo.com

fixaeo_consent180 days

Remembers the cookie choice you made on this page or in the banner, so we don't ask again on every visit. Stores only your decision, a timestamp, and which version of this policy was in force.

Readable by our own JavaScript · SameSite=Lax · Secure

fixaeo_oauth_state5 minutes

One-time anti-forgery token for signing in with Google. Deleted as soon as the sign-in completes.

HttpOnly · SameSite=Lax · Secure

fixaeo_gsc_state, fixaeo_ga4_state, fixaeo_slack_state10 minutes

The same one-time anti-forgery token, for connecting Google Search Console, Google Analytics, or Slack to your account. Only set if you start one of those connections.

HttpOnly · SameSite=Lax · Secure

Optional — analytics, only with your consent

Set only after you accept, and removed when you withdraw. Provider: PostHog (United States), acting as our processor.

ph_<project key>_posthog180 days

A first-party PostHog cookie holding a random identifier plus how you first reached the site. It lets us count unique visitors and see whether people come back, instead of treating every day's traffic as brand-new strangers.

SameSite=Lax · Secure · first-party (set by fixaeo.com)

ph_<project key>_posthog (local storage)Until you withdraw consent or clear site data

The same values mirrored in local storage, which is what PostHog reads first. Removed when you withdraw consent.

Local storage, not a cookie — but the same consent rules apply

ph_<project key>_window_id (session storage)Until the tab is closed

Distinguishes browser tabs so two tabs aren't counted as two people.

Session storage

What we get from it: honest visitor counts. Without a stable identifier, someone who visits on Monday and again on Thursday looks like two different people, so weekly and monthly "unique visitor" totals are inflated and we can't tell whether anyone comes back.

What we still don't do, consent or not: no session or screen recording, no automatic click tracking (we send a short list of named events like "started a scan"), no advertising or remarketing audiences, and no selling or sharing of your data.

If you refuse

The whole site keeps working — refusing costs you nothing. We still count page views to know which pages are read, but with no identifier stored on your device, so each visit is counted on its own and can't be linked to your next one.

If your browser sends a Global Privacy Control or Do Not Tracksignal, we treat that as a refusal automatically and don't show you the banner at all. You already answered.

How to change or withdraw your choice

Use the button at the top of this page, or the Cookie settings link in the footer of every page. Withdrawing takes the same single click as accepting, and deletes the analytics cookie immediately.
Your choice is remembered for 180 days, then we ask again — so consent stays a current decision rather than one click years ago.
We'll also ask again if we change what the cookies are used for, even if the 180 days haven't run out.
Your browser's Preferences → Privacy can block or delete cookies per site. Blocking fixaeo_session will sign you out.

Measurement that doesn't use cookies

Ahrefs Web Analytics — a cookie-free page-view counter. It sets no identifier on your device, so it runs whatever you choose above.
Cloudflare — our CDN and DDoS protection. It processes request metadata (IP, headers) to serve and protect the site and produces aggregate traffic stats. Required to run the site; sets no tracking cookie.
Google Analytics 4 was removed on 2026-05-25 and has not come back. It set _ga / _ga_* for cross-site advertising — a different purpose from counting visitors, and not one we need.

Payment checkout (Lemon Squeezy)

When you start a subscription we redirect you to Lemon Squeezy, our Merchant of Record, on their own domain (lemonsqueezy.com). Any cookies set there are first-party to Lemon Squeezy and governed by their privacy policy, not ours — they're never set on, and never reach fixaeo.com.

Changes to this policy

If we add a cookie or change what an existing one is used for, we update this page in the same release and re-ask for consent where consent is required. The date at the top is the last time anything on it changed.

Questions, or want to exercise a GDPR right? See our Privacy Policy, the subprocessor list, or email hello@fixaeo.com.