The short version
Provenfolio keeps tracking to a minimum. Without your consent, the only cookies we set are the ones needed to sign you in and to remember your privacy choice. If you allow analytics, we use PostHog (hosted in the EU) — which sets one first-party analytics cookie — and Vercel’s cookieless metrics to understand traffic and where the product needs work. We never sell your personal data, and rejecting analytics removes PostHog’s cookie and storage.
Your choice
Visitors in the EU, EEA, UK and Switzerland are asked to opt in before any analytics runs. Elsewhere, analytics is on by default and you can turn it off. Either way you can change your mind at any time: .
Strictly necessary & functional
These make the site work and can’t be switched off. Under GDPR/ePrivacy they’re exempt from consent.
next-auth.session-token
- Strictly necessary
- Keeps you signed in and secures your session. Set only after you log in.
- 7 days
next-auth.csrf-token / callback-url
- Strictly necessary
- Protects sign-in against cross-site request forgery.
- Session
pf_workspace
- Strictly necessary
- Remembers which shared workspace you are working in, when you collaborate on somebody else’s portfolio. Set only after you switch workspace.
- 30 days
pf_consent
- Functional
- Remembers your cookie choice so we don’t ask again. Stores only on/off flags — no personal data.
- 180 days
pf_region
- Functional
- A coarse “EU / rest-of-world” hint so we show the right consent default. Never stores your country or IP.
- 1 year
| Name | Category | Purpose | Duration |
|---|---|---|---|
| next-auth.session-token | Strictly necessary | Keeps you signed in and secures your session. Set only after you log in. | 7 days |
| next-auth.csrf-token / callback-url | Strictly necessary | Protects sign-in against cross-site request forgery. | Session |
| pf_workspace | Strictly necessary | Remembers which shared workspace you are working in, when you collaborate on somebody else’s portfolio. Set only after you switch workspace. | 30 days |
| pf_consent | Functional | Remembers your cookie choice so we don’t ask again. Stores only on/off flags — no personal data. | 180 days |
| pf_region | Functional | A coarse “EU / rest-of-world” hint so we show the right consent default. Never stores your country or IP. | 1 year |
Analytics (optional)
Only active when you allow it (and, outside opt-in regions, until you turn it off). Provided by PostHog (EU Cloud) and Vercel. Turning analytics off later stops all capture and deletes PostHog’s cookie and browser storage.
ph_*_posthog (cookie + browser storage)
- Analytics
- PostHog product analytics, hosted in the EU. Stores a random visitor id, the current session id and pending events, so pages, signups and product steps can be counted across visits. First-party only — no cross-site tracking. Set only after you allow analytics; rejecting later removes it.
- Cookie: 1 year. Browser storage: until you withdraw consent or clear it.
Vercel Web Analytics
- Analytics (cookieless)
- Aggregated page views and referrers. Uses no cookies and no cross-site identifiers.
- No cookie stored
Vercel Speed Insights
- Analytics (cookieless)
- Real-user performance metrics (Core Web Vitals) to keep the site fast.
- No cookie stored
| Name | Category | Purpose | Duration |
|---|---|---|---|
| ph_*_posthog (cookie + browser storage) | Analytics | PostHog product analytics, hosted in the EU. Stores a random visitor id, the current session id and pending events, so pages, signups and product steps can be counted across visits. First-party only — no cross-site tracking. Set only after you allow analytics; rejecting later removes it. | Cookie: 1 year. Browser storage: until you withdraw consent or clear it. |
| Vercel Web Analytics | Analytics (cookieless) | Aggregated page views and referrers. Uses no cookies and no cross-site identifiers. | No cookie stored |
| Vercel Speed Insights | Analytics (cookieless) | Real-user performance metrics (Core Web Vitals) to keep the site fast. | No cookie stored |
Portfolio view counts
Separately from the above, we count views of each public portfolio so its owner can see how their work is doing. This sets no cookie and reads none. Each view stores a one-way hash of your IP address and browser user-agent that is re-salted every day, so the same visitor cannot be recognised tomorrow or on a different portfolio, plus the origin of the site you arrived from — never the full URL. Your IP address itself is never stored.
If you decline analytics here, we do not record these view counts either, even though they are cookieless and non-identifying. Portfolio owners see totals for their own portfolio only, never anything about individual visitors.
Contact
Questions about this policy: privacy@provenfolio.com