Cookie policy

Last updated: 16 October 2026

Inventory under review. This list is updated whenever the providers, purposes or applicable retention periods change.

1. What cookies are

Cookies are small text files that websites store on your device. This policy also covers equivalent technologies, such as local storage, IndexedDB and PWA caches. They let us remember your session, keep your preferences and, only with your permission, measure how Clybo’ is used.

2. Types we use

By default we only use strictly necessary cookies. The rest are only activated with your explicit consent.

Your permission is stored separately on each site because the browser isolates each origin's data. PostHog is used on the landing site, the app, the dashboard, the Guardian and Staff PWAs and the public forms. Google Analytics 4 is used only on Clybo’s public landing site; it is not loaded in the app, the dashboard, the forms or the PWAs.

Category	Purpose	Status
Necessary	Session, CSRF security, language. The platform does not work without these.	Required
Analytics	PostHog on the platform; PostHog and Google Analytics 4 on the landing site. With permission and after you sign in, PostHog uses your sign-in email to link activity across sessions. We measure navigation, features used and performance to improve the product. In the family app and registration forms we also record how the screen is used to detect faults, with text, what you type and images masked before being sent.	With permission

3. Third-party cookies

We use the following providers, which may set cookies when you activate the corresponding categories:

PostHog (product and performance analytics) — measures LCP, INP, CLS and FCP and, after sign-in and only with permission, uses the normalised login email as an account identifier; it does not receive your name, other contact details, form content or interface text. In the family app and registration forms, with the same permission, it records how the screen is used (structure, clicks, scrolling and timings) to detect faults: text, what you type, images and links are masked in your browser before being sent, and recordings are kept for 30 days.
Google Ireland Limited (Google Analytics 4, on the public landing site only) — measures pages, sessions, device, browser and approximate location. We do not send account identifiers, forms or contact details; Google Signals, personalisation and advertising storage remain disabled.
Stripe (payment gateway) — necessary to detect fraud.
Cloudflare (CDN security) — necessary to protect against attacks.

4. How to manage your preferences

You can review, give or withdraw consent at any time throughCookie settings, in the footer of every page on the landing site. Withdrawal applies immediately to PostHog and to Google's consent mode, stops future measurement and deletes the_ga cookies accessible from this site. Your choice is stored per origin, so you need to change it on each Clybo’ surface you use.

If your browser sends a Global Privacy Control (GPC) signal, the landing site treats it as a refusal of optional analytics and does not load Google Analytics. We also configure PostHog to respect the browser's Do Not Track signal. We do not sell or share personal data for behavioural advertising.

5. Cookie details

Key	Purpose	Duration
`clyb:analytics-consent`	Stores your analytics choice.	Until you change your preference or clear local storage.
`__ph_opt_in_out_*`	Syncs that choice with the PostHog SDK; it contains no activity.	Until you change your preference or clear local storage.
`ph_*`	Keeps the anonymous identifier or, after sign-in, the normalised sign-in email as an account identifier, and the PostHog session; in the family app and forms, also the session recording settings.	Up to 12 months; only created after you accept.
`ph_conv_*`	Keeps your support conversation: chat session identifier, open ticket, panel state and, if you provide them, your name and email. In the management panel it is created on sign-in, because the support chat is always available; on the website and in the staff and family apps, only when you open the chat or Clybo’ support. It does not depend on your analytics choice.	Until you sign out of the panel, the staff app or the family app, or clear local storage.
`_ga`	Distinguishes landing site visitors pseudonymously in Google Analytics 4.	Up to 12 months; only created after you accept.
`_ga_VTBK4XXHN1`	Keeps the Google Analytics 4 session state on the landing site.	Up to 12 months; only created after you accept.
`clyb_adm_mfa`	Confirms the second factor in the internal administration dashboard; it is HttpOnly and not used for analytics.	12 hours.

PostHog does not store analytics identifiers or capture events before you consent. On the landing site, the browser does not download the Google Analytics tag before you accept either. Refusing or withdrawing permission stops capture; only the choice needed to respect it is kept.