1. Summary
Nose for Horse ("Nose") uses two kinds of cookies and similar browser-stored information:
- Strictly necessary cookies — set without asking you first, because the Service simply cannot work without them (keeping you signed in, remembering your language, passing bot protection, and remembering the cookie choice you already made). These are listed under “Strictly necessary (no consent required)” below.
- Optional analytics — PostHog. Everywhere except the United States, we load it only if you click "Accept" on the cookie banner; if you reject — or do nothing — PostHog is never loaded and none of its cookies or stored data are created. In the United States it is on by default and you can switch it off at any time. This is the only category that depends on your choice. It is described under “Analytics (PostHog)” below.
We do not use advertising cookies, retargeting pixels, conversion pixels, or any cross-site behavioral-profiling technology. We are not part of an advertising network and we do not share cookie data with anyone for advertising. See “Trackers we do not use” below.
On your first visit — anywhere except the United States — a cookie banner lets you accept or decline the optional analytics cookies with a single click each, and nothing is pre-checked. In the United States there is no banner: analytics is on by default. Wherever you are, you can change your mind at any time using the "Cookie settings" link in the site footer.
2. What is a cookie?
A cookie is a small text file a website stores in your browser to remember something about your visit — for example, that you are signed in. Closely related technologies do the same job in slightly different ways: local storage and session storage (key/value data kept by your browser) and pixel tags. This policy covers all of them, and we use the word "cookies" throughout to mean cookies and these equivalent technologies together.
Cookies set by Nose itself are called first-party; cookies set by a provider we use (such as our analytics provider) are called third-party.
3. Cookies we use
3.1 Strictly necessary (no consent required)
These cookies are strictly necessary to deliver the Service you have asked for — signing you in, keeping you signed in, remembering your language, protecting forms from bots, letting you into a barn’s public schedule, and remembering the cookie choice you already made so we do not ask again. Because they are essential to a service you actively requested, they are exempt from consent under Article 5(3) of the EU ePrivacy Directive (implemented in Poland by Article 399 of the Electronic Communications Law of 12 July 2024, which replaced Article 173 of the former Telecommunications Law) (and, for UK visitors, the equivalent rule in UK PECR). We do not use them for analytics, tracking, or advertising.
| Name | Purpose | Set by | Duration |
|---|---|---|---|
| `sb-<projectRef>-auth-token` (Supabase session — may be split into `.0`, `.1`, … chunks when large) | Keeps you signed in and refreshes your session without making you log in again. Cleared when you sign out. | Nose (via Supabase) | Up to 400 days, renewed each time you use Nose; the access-token portion is short-lived (~1 hour) |
| `nose_consent` | Remembers your cookie-banner choice (Accept / Reject analytics) so we don’t ask you on every visit. `HttpOnly`. | Nose | 12 months |
| `NEXT_LOCALE` | Remembers the interface language you chose. | Nose | 1 year |
| `nose_visit_<stable-slug>` | Set only when a barn’s schedule is password-protected and you enter the correct access password — it remembers that you passed, so you are not asked again on that barn’s public schedule. Signed and `HttpOnly`; scoped to that one barn. | Nose | 24 hours |
| `cf_clearance` | Records that you passed a Cloudflare Turnstile bot-protection challenge (used on sign-in, sign-up, magic-link, invitation, and public-schedule password forms). | Cloudflare | ~30 minutes |
| `cf_bm` | Cloudflare bot-management, distinguishing humans from automated traffic. | Cloudflare | ~30 minutes |
| `last_stable` | Remembers which barn you were last working in, so opening the app takes you back to it instead of to a picker. A hint only — your membership is re-checked on every request. `HttpOnly`. | Nose | 1 year |
| `last_entry` | Remembers which screen inside that barn you were last on, so the app opens on it directly. `HttpOnly`. | Nose | 1 year |
| `nose_stepup` | Records that you re-confirmed your identity for a sensitive action, so you are not asked again moments later. `HttpOnly`. | Nose | 15 minutes (up to 1 hour) |
| `nose_demo` | Set only on the public demo sandbox, once its shared front-door password is accepted, so you are not asked for it again in the same browser. It grants no access to any account. `HttpOnly`. | Nose | 24 hours |
| `nose_region` | Records which data region your account is in (`eu` or `us`), so the shared app address can send a cold app launch to the right one. One region code — never your identity, your barn, or your language. `HttpOnly`, set on `.nose.horse`. | Nose | 400 days |
In our cookie banner these are presented under a single "Strictly necessary" category (always on) that covers both the essential cookies (sign-in, language, public-schedule, consent) and the security cookies (Cloudflare Turnstile bot protection). Neither sub-group can be switched off, because the Service cannot run without them.
We do not set any payment-checkout cookies on Nose itself. Both the barn’s subscription billing (Stripe for Polish barns; Dodo Payments for barns outside Poland) and, where a barn turns them on, online rider payments (processed by Stripe) run on the payment provider’s own hosted or embedded checkout, so any checkout cookies are set by that provider on its own domain, under its own cookie and privacy notice, not by Nose. Where a barn does not use online payments, cash / pass / voucher / transfer inside the app are only labels recording how a rider paid outside it.
3.2 Analytics (PostHog)
We use PostHog (provided by PostHog Inc., hosted on its EU Cloud at `eu.posthog.com`, with data ingested via `eu.i.posthog.com`) to understand how the product is used so we can improve it. Everywhere except the United States, PostHog is loaded only after you click "Accept" on the cookie banner. In the United States, PostHog is loaded by default and stops as soon as you switch analytics off under "Cookie settings". If you click "Reject" or switch analytics off, or if your browser sends a Do Not Track / Global Privacy Control signal (see “Do Not Track and Global Privacy Control” below), PostHog is never loaded and none of the keys below are created.
When analytics is on, PostHog stores a pseudonymous identifier (a random id that distinguishes repeat visits but does not, by itself, tell anyone who you are) using cookies and/or your browser’s local storage:
| Name | Type | Purpose | Set by | Duration |
|---|---|---|---|---|
| `ph_<project_api_key>_posthog` | Cookie and browser local storage | Holds the pseudonymous device/visitor id and the analytics state, so repeat visits and page views can be counted across the same browser. | PostHog (`eu.i.posthog.com`) | 12 months (cookie); local-storage entry persists until you clear browser data or withdraw consent |
What PostHog collects (only while analytics is on): which pages you view and which buttons or screens you use (this is "autocapture" — element-level interactions such as clicks, input changes and form submissions), heatmaps (where on a page people click, how far they scroll and where the pointer moves — stored as positions on the page, not as a recording of your screen), basic web performance measurements (page-loading and responsiveness metrics — CLS, FCP, LCP, INP), and standard technical details (browser, operating system, device type, and an approximate country/region). Your IP address is discarded by PostHog at ingestion (we have enabled PostHog’s project setting "Discard client IP data"), so no raw IP is retained against your analytics profile. PostHog retains analytics events for 6 months, after which they are deleted.
Page addresses are shortened before they leave your browser. Every address we send to PostHog or Vercel Web Analytics is reduced to the kind of page it is: the barn’s name, record identifiers, one-time links and anything after a `?` are removed, so a barn’s schedule is recorded as `/:locale/:stable/schedule` whichever barn it belongs to.
What we track. We use PostHog only for pageview and interaction analytics (autocapture), heatmaps and performance metrics; we do not record or replay your screen. Outside the United States, analytics are collected only if you accept; in the United States, only until you switch them off. If you reject or switch analytics off (or your browser signals Do Not Track / Global Privacy Control), PostHog is never loaded and nothing is collected.
Legal basis. Because PostHog reads from and writes to your device, it falls within Article 5(3) of the EU ePrivacy Directive (implemented in Poland by Article 399 of the Electronic Communications Law of 12 July 2024, which replaced Article 173 of the former Telecommunications Law) (and UK PECR) and may be used only with your prior, specific, informed and freely-given consent (Article 6(1)(a) GDPR). We obtain that consent through the cookie banner described in “Summary” above. Consent is never assumed, never pre-checked, and can be withdrawn at any time (see “How to control cookies” below). In the United States, where these rules do not apply to your device and first-party product analytics is a matter of notice and opt-out, we rely on our legitimate interest in understanding and improving the product (Article 6(1)(f) GDPR); you can object at any time by switching analytics off under "Cookie settings" or by sending a Global Privacy Control signal.
Where the data goes (international transfer). PostHog runs on its EU Cloud, so analytics data stays within the European Economic Area — there is no transfer to the United States for PostHog.
Vercel Web Analytics (cookieless — no consent needed). Separately, we use Vercel Web Analytics, a privacy-preserving analytics tool that measures aggregate traffic without setting any cookies and without building a profile of you. Because it sets no cookies and does not identify or track you, it is not part of the optional analytics category above and does not depend on the cookie banner. The page addresses it receives are shortened in the same way as for PostHog. We mention it here for completeness, but it places nothing in your browser that this policy needs to list.
3.3 Marketing / advertising cookies
None. We do not use advertising cookies, retargeting or conversion pixels, audience-export tags, or any similar technology. We never share cookie data for advertising.
3.4 Trackers we do not use
To be explicit, Nose does not embed any of the following:
- Facebook / Meta Pixel
- LinkedIn Insight Tag
- X (Twitter) conversion pixels
- TikTok Pixel
- Google Ads / DoubleClick or any other advertising-network tag
- Any cross-site retargeting or behavioral-advertising technology
- Browser fingerprinting
We do not use session recording or screen replay of any kind. The analytics described under “Analytics (PostHog)” above are limited to pageview and interaction events, heatmaps and performance metrics. PostHog’s heatmaps are click, scroll and pointer positions on a page, not a recording; we do not use Hotjar, FullStory, or any other session-replay service.
If we ever add any tracker in the future, we will update this policy and request your consent before it is loaded.
4. How to control cookies
4.1 Through our cookie banner
On your first visit, anywhere except the United States, the cookie banner lets you accept or decline the optional analytics category (PostHog) with a single click each, and nothing is pre-checked. In the United States there is no banner, and analytics is on until you switch it off.
To change your choice at any time — for example, to withdraw consent you gave earlier, or to grant it — click "Cookie settings" in the site footer — in the United States, this is also where you switch analytics off. Withdrawing consent stops PostHog from loading on your next page load and does not affect anything already, lawfully, processed before you withdrew.
In the Nose app from the Apple App Store there is no banner in any country. Optional analytics stays off there until you switch it on under "Cookie settings" on your account screen; in the United States it is on until you switch it off there. Nose does not track you across other companies' apps or websites.
4.2 Through your browser
You can also control cookies directly in your browser:
- Chrome: Settings → Privacy and security → Third-party cookies / Cookies and other site data
- Firefox: Settings → Privacy & Security → Cookies and Site Data
- Safari: Settings → Privacy → Manage Website Data
- Edge: Settings → Cookies and site permissions
Blocking strictly-necessary cookies will break the Service. If you block the Supabase session cookie you will not be able to stay signed in; if you block `nose_consent`, the banner will reappear on every visit because we cannot remember your choice.
You can clear all cookies for the site at any time through your browser’s "clear browsing data" menu — doing so resets your consent choice, so the banner will appear again on your next visit.
5. Do Not Track and Global Privacy Control
We respect Do Not Track (DNT) and Global Privacy Control (GPC) signals where technically possible. If your browser sends either signal on the first request, we treat it as a rejection of the optional analytics category wherever you are, including the United States — PostHog is not loaded, and the banner is not shown. Strictly-necessary cookies and cookieless Vercel Web Analytics are unaffected, because they do not track you and are needed to provide the Service you requested.
6. Updates
We will update this policy whenever we add or change a cookie or similar technology, or change how an existing one is used. The "Last updated" date at the top always reflects the most recent revision. When we added heatmaps on 27 September 2026, we asked everyone who had accepted analytics before that date to choose again.
If we add any new non-essential technology in the future (for example, a different analytics vendor, or any advertising tracker), we will request your consent before it is set, through a clearly labeled cookie banner offering single-click "Accept" and "Reject" options.
7. Contact
Questions about cookies, or about a choice you have made: support@nose.horse.
For broader questions about how we handle your personal data, see the Privacy Policy. If you are an EU resident and are not satisfied with our response, you may lodge a complaint with the Polish supervisory authority — the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl — or your local national data-protection authority.
Nose is operated by DF Daniel Fojcik (see the Privacy Policy → “Who is responsible” for full registration details).