Nexstepper

Cookie Policy

Updated 2026-10-08

One cookie keeps you signed in. One analytics tool runs only if you say yes. That is the whole list.

At a glance

How many cookies?One first-party cookie: the session cookie that keeps you signed in. It is exempt from consent because the site cannot work without it.What is analytics?PostHog, so we can see which features are used. Off until you allow it, and anonymous by default.Any advertising cookies?None. We do not run ads, ad pixels, or cross-site tracking of any kind.How do I change my mind?Clear the choice in your browser storage and the banner returns. Rejecting costs you nothing.

1. What are cookies

Cookies are small text files that a website stores in your browser. They hold a small amount of information that lets the site recognize you across requests. We use cookies sparingly — only what we need to run the service and a single set of analytics cookies that you can opt out of.

2. Cookies we use

There are exactly two cookies, both set by Better Auth, and neither is optional — without them you cannot stay signed in. Under ePrivacy Article 5(3) they are exempt from consent, because the service cannot be delivered without them. Analytics is handled separately, in §3, and stays off until you allow it.

Essential

CookiePurposeProviderDuration
nexstepper.session_tokenAuthentication — keeps you signed in.Nexstepper (Better Auth)Session (cleared on logout)
nexstepper.session_dataShort-lived cache of your session so page loads don't re-query the database.Nexstepper (Better Auth)5 minutes

On HTTPS deployments these may carry a __Secure- prefix. That is a browser security convention, not a different cookie.

Analytics (only with your consent)

CookiePurposeProviderDuration
ph_*PostHog session + identity tracking.PostHogUp to 1 year (PostHog defaults)

PostHog cookies identify returning visitors so we can see, e.g., whether people who try the AI chat once come back. PostHog data is sent to PostHog's hosted service (US or EU region depending on our project setting) and is governed by PostHog's privacy policy.

PostHog is not initialised at all until you consent. That is enforced in code, not just in the banner: the analytics SDK loads only after your decision is recorded, so declining means nothing is sent. If you decline and reload, the request never happens.

Where your choice is stored

Your answer is kept in your browser's local storage under the key nexstepper.consent. We deliberately do not use a cookie to store consent, because doing so would mean setting a non-essential cookie before you had agreed to any. Clearing that browser storage entry simply brings the banner back.

3. Third-party cookies

Stripe sets its own cookies when you reach a checkout page. Those are used for fraud detection and payment processing, not advertising, and Stripe's full list is in their cookie notice. They are set by Stripe when you choose to pay us — not by this site, and not before then.

We do not run any third-party advertising cookies, retargeting pixels, or social media embeds that set tracking cookies. If we add any in the future, we'll update this page and ask for your consent in the cookie banner.

4. How to control cookies

Your choice is one click either way in the banner, and rejecting optional cookies costs you nothing in the product. You can also change it later: clear this site's browser storage (or use the “Customise” control when the banner is showing) and you will be asked again. Browser-level controls work as usual — blocking essential cookies will break sign-in, while blocking analytics changes nothing.

  • Chrome — Settings → Privacy and security → Cookies and other site data.
  • Safari — Preferences → Privacy → Manage Website Data.
  • Firefox — Preferences → Privacy & Security → Cookies and Site Data.
  • Edge — Settings → Cookies and site permissions → Cookies and site data.

The Global Privacy Control (GPC) signal is honoured: if your browser sends it — which you can enable in Firefox, or in Chrome/Edge extensions for California — we treat you as having declined analytics, and the banner will not keep asking.

5. Changes

We update this page whenever we add or remove a cookie. Material changes (e.g. adding advertising cookies) are announced via email and require renewed consent in the cookie banner.

  • 2026-10-08 — Consent banner introduced and analytics gated behind it: PostHog is no longer initialised until you allow analytics. GPC is now honoured in code (it was previously described here but not implemented). Removed two cookies this page listed that the application never set (nexstepper.csrf_token, nexstepper.share_token). Domain references corrected to nexstepper.com.
  • 2026-09-25 — Rebrand: cookie prefix updated from nextep.* to nexstepper.*; site name updated. Existing sessions were invalidated at the rename boundary.
  • 2026-09-24 — initial version (generated from Termly open templates).

6. Contact

Questions about cookies: privacy@nexstepper.com.