This page lists every cookie that can be set when you use EmailFig, whether it's one we set ourselves or one set by a provider we rely on. It's a companion to our Privacy Policy, not a replacement for it.
What cookies are
A cookie is a small piece of data a website asks your browser to store and send back on later requests. Sites use them to stay signed in, remember settings, and (on many sites, though not this one) track behaviour across the web for advertising. Where a provider uses local storage instead of a cookie for the same purpose, we've noted that below rather than drawing an artificial line between the two.
Cookies EmailFig sets
We set exactly one cookie ourselves:
| Cookie | Purpose | Duration |
|---|---|---|
| session_id | Keeps you signed in. Strictly necessary: without it, every page would ask you to sign in again. | 30 days, renewed while you're active; cleared immediately when you sign out |
This cookie is signed and httponly, so it can't be read or altered by page JavaScript, and it's never set on the recipient-facing pages your subscribers see (unsubscribe links, the preference centre, "view in browser," or your embedded and hosted signup forms). Those pages don't require sign-in and set no cookie of ours at all.
Cookies our providers set
A few pages load a provider's script for a specific job, and that provider may set its own cookie while it runs:
| Provider | Purpose | Where it loads |
|---|---|---|
| Cloudflare Turnstile | Distinguishes a human from a bot without a puzzle captcha. Strictly necessary for the pages that use it: abuse prevention, not tracking. | The sign-in page, and the verification step on embedded signup forms hosted on other sites |
| Stripe | Fraud prevention while you enter a card. Strictly necessary for that form to work. | The "update payment method" page in account settings: signed-in users only, never on a public page |
| PostHog | Product analytics (which pages and features get used) so we know what to fix. Not used for advertising. | The app, sign-in, and marketing pages only. Deliberately absent from every recipient-facing page for the same reason it's absent from tracking your subscribers: that traffic isn't ours to instrument. |
| Google Analytics | Traffic analytics: pageviews, sessions, and referrers for our public pages. Configured for analytics only: no Google Signals, ad personalization, or remarketing. | Our marketing pages, blog, and help centre. Like PostHog, never on a recipient-facing page. |
PostHog primarily uses your browser's local storage rather than a cookie to remember who you are between visits, with a cookie as fallback where local storage isn't available. Either way, the purpose and the data involved are the same, and it's covered by this page and our GDPR page. Google Analytics sets _ga and a per-property _ga_<container-id> cookie, each kept for up to 2 years, to tell repeat visits apart from new ones.
What we don't use
No advertising or cross-site tracking cookies, on any page (ours or your subscribers'). We don't sell data to ad networks, and we don't run retargeting pixels. If that ever changes, it'll show up on this page before it ships, not after.
Managing cookies
Your browser lets you block or delete cookies (usually under Settings → Privacy), and most browsers let you do this per-site rather than everywhere at once. Blocking session_id means the app can't keep you signed in; blocking Cloudflare Turnstile's cookie may prevent sign-in or a public form submission from completing its verification step. Blocking PostHog or Google Analytics costs you nothing functional: it only stops us from seeing that visit in product or traffic analytics. Google also offers a browser add-on that opts you out of Google Analytics on every site that uses it, not just this one.
Changes & contact
We'll update this page whenever a cookie is added, removed, or changes purpose: a new integration doesn't ship silently. For material changes we'll also note it in the Privacy Policy's change history.
Questions about a specific cookie? Write to contact@emailfig.com. A human replies.