Cookie Policy
Last updated: November 11, 2026
This page needs legal review before it is treated as a public commitment. Durations, vendor names, and the category split below are taken from the current implementation. TODO(legal): confirm controller identity, EU representative (if any), lawful basis, and third-party retention periods.
1. How we ask
The first time you visit notfair.co, a banner offers Reject all and Accept all with equal prominence, plus granular Analytics and Marketing preferences. Your choice is stored in the strictly necessary nf_consent cookie. You can reopen the choice from Manage cookies in the site footer, or on this page.
Until you accept a category, we do not load PostHog, the Google Ads tag AW-18054900065, the Meta Pixel, the TikTok pixel, Rewardful, or our nf_first_touch / nf_latest_paid_touch cookies. Rejecting keeps those tags and cookies off. Accepting loads only the categories you allowed, without requiring a page reload. Withdrawing later stops capture and expires those cookies as far as a first-party page can.
2. Categories
- Necessary: required for the site to work (this choice, sign-in, language, theme). These are always on.
- Analytics: PostHog product analytics. Session recording starts only after this category is accepted. All form inputs are masked.
- Marketing: advertising pixels, affiliate attribution, and our first-touch / paid-touch cookies.
3. Cookies and tags
| Name | Category | Provider | Duration | Purpose |
|---|---|---|---|---|
| nf_consent | Necessary | NotFair | 180 days | Stores your analytics and marketing cookie choices so we can honor them on later visits. |
| NEXT_LOCALE | Necessary | NotFair | 365 days | Remembers the language you selected. |
| nf_theme_preference | Necessary | NotFair | 365 days | Remembers a light or dark appearance you chose. |
| Supabase auth session (sb-*-auth-token) | Necessary | NotFair / Supabase | Session / rotating refresh | Keeps you signed in. Set only after you sign in. TODO(legal): confirm exact names and refresh lifetime against the live auth configuration. |
| PostHog (ph_* / distinct_id) | Analytics | PostHog, Inc. | Up to 1 year (vendor default). TODO(legal): confirm against the live PostHog project. | Product analytics (page views and in-product events). Session recording starts only after analytics consent. Form fields are masked. |
| Google Ads tag AW-18054900065 | Marketing | Google LLC | Up to 90 days for conversion-linker cookies (_gcl_*). TODO(legal): confirm current Google Ads cookie durations. | Measures ad clicks and sign-up conversions. Loaded only after marketing consent. Consent Mode v2 defaults to denied until then. |
| Meta Pixel 882703651527903 (_fbp, _fbc) | Marketing | Meta Platforms, Inc. | Up to 90 days. TODO(legal): confirm current Meta Pixel cookie durations. | Measures ad clicks and conversions on Meta ads. |
| TikTok Pixel D84CM1JC77U42GL8VQ50 (_ttp, ttcsid) | Marketing | TikTok Pte. Ltd. | Up to 13 months (vendor typical). TODO(legal): confirm current TikTok pixel durations. | Measures ad clicks and conversions on TikTok ads. |
| X Pixel q27qa | Marketing | X Corp. | Vendor-controlled. TODO(legal): confirm current X pixel cookie names and durations. | Measures ad clicks and conversions on X ads. |
| Reddit Pixel (when configured) | Marketing | Reddit, Inc. | Vendor-controlled. TODO(legal): confirm current Reddit pixel cookie names and durations. | Measures ad clicks and conversions on Reddit ads when a pixel ID is configured. |
| OpenAI Ads pixel (when configured) | Marketing | OpenAI, Inc. | Vendor-controlled. TODO(legal): confirm current OpenAI Ads pixel cookie names and durations. | Measures ChatGPT Ads conversions when a pixel ID is configured. |
| Rewardful (rewardful.referral / r.wdfl.co) | Marketing | Rewardful, Inc. | 60 days | Attributes affiliate referrals so we can pay commissions. |
| nf_first_touch | Marketing | NotFair | 180 days | Stores the first landing URL, UTM parameters, and click IDs so we can attribute sign-up to a campaign. |
| nf_latest_paid_touch | Marketing | NotFair | 90 days | Stores the latest paid-click parameters (for example gclid or fbclid) when they are present. |
| __utm_* session storage | Marketing | NotFair | Browser session | Temporarily holds UTM parameters and the external referrer until they can be written to the first-touch cookie after marketing consent. |
4. Google Consent Mode
If the Google tag runs, it starts from Consent Mode v2 defaults of denied for ad_storage, ad_user_data, ad_personalization, and analytics_storage. We do not load googletagmanager.com until you accept marketing cookies.
5. Contact
Questions about cookies: tong@notfair.co. See also the Privacy Policy.