Cookie Policy

1. Overview

A cookie is a small text file that your browser stores when you visit a website. The browser sends it back to that site on later requests so the site can remember context like your sign-in state. Local storage and session storage are related browser features: data sits on your device and is never automatically sent to a server. Local storage stays until you clear it. Session storage is cleared as soon as you close the tab.

InsightLoop sets two categories of entries only:

• Strictly necessary. Needed to deliver the service, including keeping you signed in, securing requests, and keeping multiple open tabs consistent.
• Preference. Records a choice you have made in the product, such as your theme or sidebar layout.

There are no advertising, analytics, or third-party tracking cookies set by InsightLoop, on the marketing site or anywhere else in the product.

2. Legal basis and consent

Under the EU ePrivacy Directive, the UK Privacy and Electronic Communications Regulations, and equivalent rules in Switzerland, a site must obtain a visitor’s consent before storing or reading information on their device, except where that storage is strictly necessary to deliver a service the visitor has explicitly requested, or where it records a preference the visitor has actively set.

Every entry we set falls into one of those two exempt categories, so we do not display a consent banner. If we ever introduce cookies or storage that fall outside this scope, this page will be updated and a consent request will be presented in the product before the new entries are set.

You can clear or block any of the entries listed below at any time from your browser settings. See Managing cookies in your browser for the practical steps.

3. Cookies we use

The two session cookies are marked HttpOnly (so JavaScript on the page cannot read them), Secure (so they are sent only over HTTPS), and SameSite=Lax (so they are not sent on cross-site requests). The sidebar and last-sign-in-method cookies are readable by JavaScript by design, so the dashboard layout and login screen render correctly on the very first paint. The last-sign-in-method cookie holds only the name of the provider you last used, such as Google, never your credentials.

Feedback portals can run on their own web address: a subdomain of our site, or a custom domain set up for the portal. Because a cookie belongs to a single host, signing in on a portal sets these session cookies on that portal’s host rather than sharing them with our main site, so each host keeps its own sign-in. They are the same cookies described above, and this policy covers them on every host, including custom domains.

4. Local and session storage we use

These entries are stored on your device and are never sent to our servers as part of a request. They hold only simple, non-personal values. The theme entry is one of “light”, “dark”, or “system”. The setup entries hold a short goal label and a hidden marker. The cross-tab entry holds a short-lived sign-in event with no personal information. The plan-limit entry holds a short marker of the notice you dismissed.

5. What we do not use

• No advertising, marketing, or retargeting cookies
• No analytics platforms (no Google Analytics, Plausible, Mixpanel, PostHog, Amplitude, Heap, or similar)
• No social-media tracking pixels (no Facebook, X, LinkedIn, TikTok, or Reddit)
• No session replay, heatmaps, or fingerprinting (no Hotjar, FullStory, LogRocket, or similar)
• No cross-site tracking and no third-party cookies

We use Sentry for error monitoring, with session replay turned off. In that setup it sets no cookies and stores nothing on your device, so the exclusions above still hold. The diagnostic data Sentry processes is described in our Privacy Policy.

On public feedback portals, we use Cloudflare Turnstile to confirm that an anonymous visitor is a real person before accepting a vote, comment, or new feedback. It loads only when you first take one of those actions, and InsightLoop sets no cookies of its own for it. Turnstile is a privacy-first check that does not track you across sites, and in our configuration it places no clearance cookie on your device. Any storage its widget needs to run that one check belongs to Cloudflare and is governed by their privacy policy. The limited data it processes is described in our Privacy Policy.

When you subscribe, LemonSqueezy’s hosted checkout opens over the page in a frame served from their own domain, and managing billing takes you to their billing portal. Any cookies set there belong to LemonSqueezy and are governed by their cookie and privacy policies, not this one. The LemonSqueezy script that opens the checkout sets no cookies on our site, and InsightLoop sets none on LemonSqueezy’s pages.

If we ever introduce a tool whose cookies fall outside the two categories described above, this page will be updated before the change ships, and where consent is required by law we will ask for it in the product before the new cookies are set.

6. Managing cookies in your browser

Every modern browser lets you view, block, and delete cookies and local-storage entries. The exact path depends on the browser:

• Chrome and Edge: Settings → Privacy and security → Cookies and other site data
• Safari: Settings → Privacy
• Firefox: Settings → Privacy & Security
• Brave, Arc, and Vivaldi: comparable paths under the browser’s privacy or shields settings
• Mobile browsers: inside the iOS or Android settings for each browser

If you block or delete the two session cookies you will not be able to stay signed in to InsightLoop. The sidebar preference cookie is safe to remove. The dashboard will simply open with the sidebar expanded next time. Clearing the theme entry resets the theme to your operating system default.

7. Do Not Track and Global Privacy Control

Browsers can send a Do Not Track (DNT) header or a Global Privacy Control (GPC) signal to indicate that the visitor does not want their personal information sold, shared, or used for cross-site tracking.

InsightLoop does not engage in the activities those signals are designed to restrict. We do not sell or share personal information, we do not serve advertising, and we do not use cross-site tracking. Receiving a DNT or GPC signal therefore does not change how we process data, because there is nothing to switch off. If our processing ever expands beyond what is described in our Privacy Policy, we will honour valid GPC signals from that point on.

8. Changes to this policy

When we update this Cookie Policy, the “Last updated” date at the top is revised. If a change adds a new category of cookies, expands the purpose of an existing one, or introduces processing by a third party, account holders will be notified by email or in-product at least 30 days before the change takes effect, and where consent is required by law we will request it before the new cookies are set.