This notice supplements our Privacy Policy and the concise Trust page. It covers cookies, local storage, session storage, browser analytics, and closely related browser processing in the hosted service. If this notice conflicts with the Privacy Policy, the Privacy Policy controls.
1. Current cookies and browser storage
The hosted service uses the following first-party storage to provide requested features. Most of it appears only after you sign in or use the relevant feature. Blocking it can stop sign-in, team selection, or saved interface preferences from working.
| Technology and lifetime | Purpose |
|---|---|
| Auth.js cookies: authjs.session-token (30-day default session maximum), authjs.callback-url, and authjs.csrf-token. Relevant sign-in flows can also use 15-minute authjs.pkce.code_verifier, authjs.state, authjs.nonce, and authjs.challenge values. HTTPS deployments add framework secure prefixes, and large session values can be split into numbered cookie chunks. A session ends earlier on sign-out. | Keep you signed in and protect authentication flows. Session and security values are HTTP-only where the framework permits it. |
| pending_invite, a signed HTTP-only cookie lasting 15 minutes. | Preserve an invitation while a user completes an external sign-in flow. |
| tl_active_team, a host-only, HTTP-only, SameSite=Lax cookie lasting up to 30 days. It is Secure in production and available across the service path. | Remember the selected workspace. The server rechecks membership before using the stored team identifier. |
| timeline_sidebar_expanded, a cookie lasting up to one year, and timeline.sidebar.expanded in local storage until it is replaced or browser data is cleared. The cookie is scoped to /app, and Timeline reads the local-storage preference only in that route area. | Remember whether the signed-in workspace sidebar is expanded. |
| tl-theme in local storage until it is replaced or browser data is cleared. | Remember the light, dark, or system appearance preference. |
| tl-coachmark:* in local storage until browser data is cleared. | Remember that a particular in-product hint was dismissed. |
| timeline:floating-agent-chat:<team>:session in local storage for no more than seven days. Invalid, legacy, and expired entries are removed; all entries in this family are cleared when you sign out through the user menu. | Store a chat-session identifier so the floating Ask panel can reopen the same conversation. It is an identifier, not the conversation body. |
| timeline:chat-handoff:<team> in session storage. It is removed when read, ignored after five minutes, and otherwise ends with the tab session. | Carry a one-time Ask prompt or page context into the full chat. A prompt can contain up to 4,000 characters, so this entry can contain text you typed. |
| tl_analytics_consent, a first-party cookie lasting up to 180 days. | Remember the version, accepted or rejected analytics choice, and choice time. A rejection contains no PostHog, account, user, team, session, or device identifier. |
| tl_public_attribution, a first-party cookie lasting up to 30 days, created only after analytics is accepted and a reviewed UTM parameter is present. | Remember the first reviewed source, medium, campaign category, and first-touch time for registration attribution. Only reviewed categories, including an explicit “other” category, are stored. Unknown or free-text values, click IDs, and other query values are discarded. |
| ph_timeline_public_analytics_v1 in local storage, created only after analytics is accepted on an eligible public page. PostHog can also keep bounded session-window keys with that prefix. | Maintain a pseudonymous public-site visitor and session for manual, allowlisted PostHog events. It is not identified, aliased, or grouped to an account, user, or team, and it is cleared when analytics is rejected or withdrawn. |
| tl_posthog_consent_v1 in local storage after analytics is accepted on an eligible public page. It remains until Timeline removes it, the value is replaced, or browser data is cleared. | Let the PostHog SDK apply the separate Timeline analytics choice without sending an opt-in event. Timeline removes it when analytics is rejected or withdrawn and before entering a private app route. |
| Legacy am_vid, am_sid, and am_stvalues may remain in browsers that previously loaded the removed Convex-hosted page tracker. | Current source no longer writes or sends these values. Rejecting or withdrawing in Cookie settings clears them. Historical provider data and the old deployment still require an operator review before any deletion claim. |
These entries are used to provide a feature, remember a choice, or protect the service. We do not treat acceptance of the Terms of Use or Privacy Policy as permission for optional browser analytics.
2. Optional public browser analytics
PostHog is the processor for optional public browser analytics. Its purpose is to measure visits and selected actions on allowlisted public pages after a separate affirmative choice. Consented pageviews also measure referring sites and popular pages using reviewed public paths and referring website origins. Query strings, fragments, referrer paths, and page titles are excluded. Consent format version 2 asks again before enabling these fields; an earlier choice does not authorize them. Recording remains off. Pay-as-you-go currently documents seven-year product-event retention, which exceeds Timeline's 90-day target. The source-controlled Cookie settings control records that choice. Reading this notice alone does not accept analytics. If this deployment has no reviewed PostHog browser key, the control reports analytics as unavailable and cannot record an acceptance that silently activates later.
When optional analytics is configured and accepted:
- PostHog loads only on source-allowlisted public marketing, help-article, Trust, and legal pages after a separate affirmative choice.
- PostHog must not initialize in signed-in or private workspace routes and must never receive workspace content, prompts, search terms, file names, user IDs, or team IDs from those routes.
- Rejecting or withdrawing means zero PostHog browser events, cookies, local-storage values, session identifiers, or visitor identifiers from that point forward.
- Autocapture, heatmaps, session replay, and automatic capture outside the approved public event allowlist remain off.
- A separate server counter may keep personless surface-request totals for broad public page categories. It does not carry a browser, visitor, session, user, or team identifier. Bots and retries can contribute, so these totals are not visitor or session metrics. An analytics rejection does not disable this separate count.
A public PostHog identity is pseudonymous, not anonymous. Production region, retention, account access, contract, deletion, and configuration evidence must still be verified before stronger deployment claims are made.
3. Implementation and deployment status
Repository controls can enforce the browser boundary, but they cannot prove provider-account or production settings. The analytics owner must verify the remaining deployment values.
| Required deployment value | Current status |
|---|---|
| Consent-choice storage name, scope, and lifetime | tl_analytics_consent; first party; service-wide path; up to 180 days. |
| PostHog browser storage | Local-storage-only persistence named ph_timeline_public_analytics_v1; exact provider retention remains unverified. |
| PostHog project host, processing region, and account access | EU Cloud project reviewed 26 August 2026. Production access and deployment evidence remain incomplete — do not enable optional browser analytics yet. |
| Event and property allowlist | Manual public_page_viewed and public_cta_clicked events with fixed surface and action values, plus manual $pageview events with reviewed public paths and referring website origins/hostnames. Project-level client IP discard is enabled; production payload evidence remains open. |
| Provider retention, deletion workflow, DPA, and transfer safeguard | Pay-as-you-go currently documents seven-year product-event retention, which exceeds Timeline's 90-day target. Legacy deletion is queued; completion, DPA, and transfer evidence remain open — do not enable optional browser analytics yet. |
| Deployed date, responsible owner, and production canary | Not yet recorded — repository implementation is not production evidence. |
4. Choosing, rejecting, and withdrawing
Use Cookie settings to accept, reject, or withdraw optional public analytics. Rejecting and accepting are equally available when PostHog is configured. Withdrawal stops future browser collection and clears Timeline's public PostHog, attribution, and legacy Convex tracker storage from this browser. It does not change the lawfulness of earlier processing or automatically erase provider records already received.
You can also delete or block cookies and site storage in your browser. Doing so can sign you out, forget your selected team or appearance, dismiss a pending invitation, or clear a one-time chat handoff.
5. Related processing that is separate from optional analytics
- Sentry: when configured, Sentry receives minimized error diagnostics to protect and debug the service. It is separate from PostHog analytics and is not switched on by an analytics choice. Default PII collection is disabled and known cookies, credentials, and token-bearing URLs are scrubbed, but unexpected error or breadcrumb text can still contain personal data. Project region and retention remain to be verified.
- Cloudflare Turnstile: in production, signup and support forms can load a challenge for abuse prevention. Cloudflare processes browser and network signals under its own service configuration. It is not advertising analytics.
- Server logs: infrastructure can process request metadata for delivery, security, and reliability. Those logs are governed by the Privacy Policy, not an optional analytics preference.
- Static repository documentation: some separately served documentation currently requests font assets from Fontshare and jsDelivr. Those providers can receive ordinary request metadata. This is an open provider-inventory item, not a claim that those pages are third-party-free.
6. Changes and contact
We will update this inventory before adding a new browser technology or enabling optional analytics. Privacy questions and requests can be sent to [email protected]. Security and provider boundaries are summarized on the Trust page.