Cookies
Last updated 24 August 2026
Nothing that measures you runs on this site unless you say so. Two cookies keep you signed in and remember your answer; everything else in the table below exists only if you accepted it, and disappears if you change your mind. Mochi itself — the app on your Mac — has no telemetry at all, whatever you choose here.
What happens if you do nothing
Nothing loads. No Google, no Meta, no PostHog — not a script, not a “cookieless ping”, nothing. Until the banner is answered, the only things stored on your device are the two sign-in cookies and the record of the fact that you have not answered yet.
That is stricter than most sites, including most that display the same banner. The common arrangement loads the measurement library immediately and asks it to hold back its cookies; we do not load it. It costs us some data about people who never answer, and it is the only version of “we asked first” that is literally true.
Refusing is one button, the same size as accepting, on the first screen. If you have ever hunted through three panels for a “reject” link, that is the pattern this is deliberately not.
The three categories
| Category | What it is for | What makes it lawful |
|---|---|---|
| Strictly necessary | Signing in, and remembering the choice you make about the other two. There is no version of the site that works without them, so they are not offered as a choice. | No consent required — ePrivacy exempts storage strictly necessary for a service the user asked for. |
| Measurement | How many people read a page, which ones download the app, and where in the process people give up. Used to decide what to build and what to rewrite. | Your consent, and nothing loads until you give it. |
| Advertising | Whether an advertisement we paid for led to a download or a purchase — so we can stop paying for the ones that did not. This is the category that shares data with a company outside the EU. | Your consent, and nothing loads until you give it. |
The two optional ones are genuinely separate. Accepting measurement and refusing advertising is a real choice and it works: Meta is never contacted, no advertising cookie is written, and the purchase reporting our server does afterwards is told the same thing.
Every cookie, by name
| Cookie | Set by | What it does | How long | Category |
|---|---|---|---|---|
| sb-<project>-auth-token | Supabase | Keeps you signed in to your account. Set by Supabase, our sign-in provider. | Until you sign out, or the session expires | Strictly necessary |
| sb-<project>-auth-token-code-verifier | Supabase | Held for a few minutes between asking for a sign-in link and clicking it, so the link can only be completed by the browser that asked. | Minutes | Strictly necessary |
| mochi_consent | Mochi | Remembers the choice you made about the rest of this table, so you are not asked again on every page. | 6 months | Strictly necessary |
| mochi_checkout_email | Mochi | Holds the address you typed before payment, so the page you return to can offer to sign you in as you rather than asking you to remember. | 1 hour | Strictly necessary |
| _ga, _ga_<id> | Tells Google Analytics that two page views came from the same browser, so a visit can be counted once rather than nine times. | 2 years | Measurement | |
| ph_<key>_posthog | PostHog | The same job for PostHog: which events belong to one visit, and which of the site's steps people give up on. | 1 year | Measurement |
| _fbp | Meta | Identifies this browser to Meta, so an advertisement we paid for can be connected to a download or a purchase that followed it. | 3 months | Advertising |
| _fbc | Meta | Records which advertisement you clicked, if you arrived from one. Set only in that case. | 3 months | Advertising |
| _gcl_au | Google Ads' equivalent: which advertisement, if any, led to a purchase. | 3 months | Advertising |
The sign-in cookies are marked HttpOnly, meaning no script on the page can read them, and they carry nothing about what you browse. The consent cookie holds five values: a version number, your two answers, the time you gave them, and which button you pressed.
Changing your mind
Here, at any time. It takes effect immediately — the cookies in the table are deleted from your browser and the page reloads without the scripts in it.
If your browser sends a Global Privacy Control signal, advertising stays switched off without you doing anything, and we honour that wherever you live rather than only in the places that require it.
You can also block or clear cookies for this site in your browser’s privacy settings. The only consequence is that you cannot stay signed in, so the account page will keep asking. Everything else on the site, and all of Mochi itself, is unaffected.
What is still not here
- No session recording, no heatmaps, no watching your pointer move.
- No automatic capture of what you click or type. Only the handful of named events listed in the privacy policy are recorded.
- No selling of data, to anybody, in any category, ever.
- No third-party embeds that watch you — no YouTube player, no social widgets.
- Nothing at all in the Mac app. It has no analytics, no telemetry and no crash reporting, and none of the companies above are ever contacted by it. This page is about these web pages only.
Questions
Write to privacy@getmochi.app. If you want what has already been counted about you deleted rather than merely stopped, say so and we will do it — that request reaches further than the button above, which can only affect your own browser.