1. What Are Cookies

Cookies are small text files placed on your device by websites you visit. They serve a range of functions — from keeping you logged in, to remembering your preferences, to helping us understand how the platform is being used.

The Signa platform uses cookies and similar local storage technologies to provide core functionality, maintain your session, and (with your consent) analyze how the platform is used so we can improve it.

2. What We Store

2.1 Essential Cookies (Always Active)

These are strictly necessary for the platform to work and cannot be turned off:

sb-[project]-auth-token (may be split into numbered parts). Supabase sign-in session. Keeps you logged in until you sign out or the session expires, for up to 400 days.

Legal basis: strictly necessary to provide the service you request. No consent required.

2.2 Functional Cookies

signa_ref. Set only when you arrive through a referral link, so the referral can be credited when you sign up. Expires after 30 days or when you sign up.

2.3 Local Storage

Some preferences are kept in your browser's local or session storage rather than in cookies. They stay on your device and are not sent to us with each request:

signa_theme. Light or dark mode.
signa_nav_collapsed. Whether the sidebar is collapsed.
signa_cookie_consent. Your choice in the cookie banner, so it is not shown on every visit.
signa_step_up_verified_at (session storage). When you last confirmed your identity for a sensitive action. Cleared when you close the tab.
signa_analytics_id (session storage). A random id for signed-out product analytics during that visit. Sent only while analytics is on. If session storage is blocked, that request uses a new random id and nothing is stored.
signa_ph_id and signa_ph_attr. While analytics is on, the same anonymous id and the first-touch campaign fields (utm, referrer, landing page) are stored in a first-party cookie so getsigna.ai and app.getsigna.ai share one PostHog person. On getsigna.ai the cookie domain is .getsigna.ai. They store no name, email, or phone. They are cleared when analytics is turned off, and they are not set when Global Privacy Control or Do Not Track is on. Checkout copies them onto the Stripe session so a trial or paid invoice can be tied to that visit.
signa_login_event (session storage). A flag set when a sign-in succeeds and analytics is already on. It stores no account details, it is not sent to the server, and it is cleared when the login event is sent or when analytics is turned off. It is not set before that choice.
signa_agent_opened (session storage). Which agents this visit already counted, so opening one is not sent again on every reload. It is not sent to us.

2.4 Analytics (Optional)

With your consent, we use Vercel Web Analytics to count page views and feature use. It does not set cookies or use local storage, and it does not identify you personally or follow you across other websites. It runs only if you choose "Accept All" or turn analytics on in Cookie Settings, and never when your browser sends a Global Privacy Control or Do Not Track signal.

With that same choice, Signa sends product events to PostHog: page views, a login, opening the chart, signals, or Alpha Chase, opening an agent (once per visit), creating an agent, and running an agent yourself. A signed-in event uses your account id. A signed-out page view uses the random visit id above, the same id on the marketing site and the app. The id is not your name, email, or phone. These events are sent only while analytics is on, and never when your browser sends Global Privacy Control or Do Not Track. Turning analytics off stops them. When a subscription trial starts or a subscription invoice is paid, our server records that with the account id. The anonymous visit id is used only to merge the earlier visit into that account.

While analytics is on, the browser sets a first-party cookie, signa_analytics, so the server can apply that choice to creating an agent, to a manual run, and to any API or MCP call the browser itself makes. It stores no account details. It is cleared when you turn analytics off, and it is not set when Global Privacy Control or Do Not Track is on. Scheduled agent runs are still recorded on our servers. A status copy of a scheduled run may be sent to PostHog with the account id only. API key and MCP use from a server or MCP client that never sees this banner are recorded with the account id only, and are skipped when that request sends Global Privacy Control or Do Not Track. A request the browser makes is recorded only while analytics is on.

Legal basis: consent.

2.5 No Advertising or Third-Party Tracking

We do not use advertising cookies, retargeting pixels, or third-party behavioral tracking. We do not participate in advertising networks or share cookie data with third parties for advertising.

3. Managing Your Choices

Cookie Settings: Choose "Accept All", "Essential Only", or "Manage Settings" in the banner shown on your first visit, or open Cookie Settings from the footer at any time. Turning analytics off takes effect immediately.
Browser signals: We honor Global Privacy Control and Do Not Track by keeping analytics off.
Browser settings: You can block or delete cookies and local storage in your browser. Blocking essential cookies will stop you from signing in.

4. Third-Party Content

Pages load fonts from Google Fonts, which receives your IP address and browser information when fonts are downloaded. Payment pages are hosted by Stripe (Link), and sign-in with Google is handled by Google; those services set their own cookies under their own policies.

5. Updates to This Policy

We may update this Cookie Policy to reflect changes to our cookie practices. Updates will be communicated via the cookie banner or a notice on the platform. The date above reflects the most recent revision.

6. Contact

For questions about cookies or our tracking practices: support@getsigna.ai