Cookie Policy

What we store on your device

Cookies are small values stored by your browser and sent with matching requests. We also use localStorage and sessionStorage. The rules for optional tracking apply to these technologies too, not just cookies.

Necessary and requested functionality

lirova_session: a cookie set by our API after sign-in, valid for up to 7 days. It carries your authentication token, is inaccessible to JavaScript (HttpOnly), and uses Secure and SameSite=None in production. Signing out clears this cookie.

NEXT_LOCALE: a first-party session cookie used to remember your selected language.

lirova_cookie_consent: a first-party cookie that remembers your analytics choice and policy version for 180 days. It is used only to respect that choice.

lirova.support.session, lirova.support.email and lirova.support.conversation: first-party cookies used when you open and use support. They contain a random support session identifier, your contact email and a conversation identifier. They are session cookies, use SameSite=Lax and Secure on HTTPS, and are not used for analytics. Older one-year chat cookies are converted to session cookies when you next open support. Browser session-restore features may retain session cookies.

localStorage: lirova.session stores a non-secret sign-in indicator until sign-out or removal; lirova.stripeRetriesAck remembers your acknowledgement in Settings until changed or removed. sessionStorage: lirova.returnTo remembers where to return after sign-in and is then removed; lirova.connectSupportPrompt.dismissed remembers a dismissed support prompt for the tab session.

These functions operate independently of optional analytics. Blocking their storage in your browser may affect sign-in, language preferences or support.

Optional analytics — only with your permission

When analytics is configured and you choose Allow analytics, we use PostHog to measure page visits and interactions and diagnose browser errors. PostHog may receive browser/device information, a pseudonymous identifier, page paths and error details. We remove query strings and fragments from the URL properties we send. We do not enable advertising trackers or session recordings in this configuration.

PostHog stores its analytics identifier in a first-party cookie named ph_<project-key>_posthog, with a configured lifetime of 90 days that may renew during use. It may also use ph_ sessionStorage entries for tab/session bookkeeping. Its scripts and events are routed through /ingest to PostHog’s US service.

No browser analytics is initialized before you allow it. Rejecting optional cookies does not prevent you from using the site, signing in or contacting support. Server-side operational logging is separate from browser analytics and is described in our Privacy Policy.

Change or withdraw your choice

Use Cookie settings in the lower-left corner of any page to allow analytics or reject optional cookies. Both choices are available without signing in. Rejecting after accepting stops browser analytics, removes accessible PostHog cookies and browser-storage identifiers, and reloads the page. It does not undo data already sent; contact us about data rights.

We ask again after your 180-day choice expires or when the consent version changes. You can also remove cookies and browser storage using your browser settings. Choices apply to the browser and site where you make them.

Other services and contact

Stripe’s sign-in and payment pages run on Stripe’s own domains and may use their own cookies under Stripe’s policies. Our support messages are handled by Lirova and mirrored to our team in Telegram; this does not load a Telegram tracking widget in your browser. Our Privacy Policy and Data Processing Agreement describe personal-data processing and service providers.

For cookie or privacy questions, write to legal@lirova.app.