Cookie Policy
Effective: 2026-10-09
This policy covers the marketing site at xscalerlabs.com, the documentation site, and the management portal. It sits alongside the Privacy Policy, which governs everything we do with personal data.
1. What cookies are
Cookies are small text files a site stores on your device through your
browser. Some are needed for a site to work at all. Others record how a site
is used. We also use localStorage, which works the same way from your
point of view and is covered by this policy.
2. What this site sets
Optional analytics is off until you choose Accept. Rejecting it does not affect access to the site. We rely on your consent for this storage and analytics processing. Closing the settings dialog is not acceptance.
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
xscaler.analytics-consent.v1 | xScaler (localStorage) | Strictly necessary record of your accepted or rejected choice, notice version and decision time. Not used for tracking. | 180 days |
ph_*_posthog | PostHog (cookie and localStorage) | Optional pseudonymous visitor/session identifiers and broad entry-source category for the consented measurements below. Only after acceptance. | Cookie: up to 180 days; local storage cleared on withdrawal or when expired consent is next checked |
| Other PostHog entries containing our project token | PostHog (localStorage and sessionStorage) | SDK consent and session state, only after acceptance. | Session storage ends with the tab; cleared on withdrawal or expired consent |
xscaler-theme | xScaler (localStorage) | Remembers light or dark mode. Never leaves your browser. | Until you clear it |
xscaler.analytics-internal | xScaler (localStorage, only when explicitly set by a tester) | Marks consented internal test traffic for exclusion from business reports. Does not enable analytics or override consent. | Until removed by the tester |
Marketing-site analytics is sent to PostHog EU Cloud. Analytics identifiers are scoped to the current website hostname, not shared with the portal or other subdomains. Consent preferences apply to this browser and website origin, not other devices or sites.
After acceptance, we collect page paths, limited link/button interactions, pricing-section views and calculator interactions. Signup and demo link clicks measure intent, not completed accounts or bookings. We do not send form contents or the workload values and cost estimates entered in the calculator.
We classify the current page's entry into a broad category: direct, organic search, paid search, social, email, referral, internal or unknown. This uses recognised campaign categories or the referring site's hostname only after consent. We send the category, not campaign values, click IDs, search terms or referring URLs. This is not cross-domain or lifetime attribution.
We also send numeric Core Web Vitals measurements for page loading (LCP), responsiveness (INP) and layout stability (CLS). We do not send metric attribution, DOM content or raw performance entries. Some metrics are available only when a page is hidden or after a qualifying interaction.
URL query strings and fragments are removed from event properties. Element text and attributes are masked; form-input changes and submissions are not autocaptured. We do not create person profiles. Our PostHog project is configured to discard client IP data after processing; transformations such as location enrichment can use it before it is discarded. Network requests necessarily expose your IP address to the receiving service.
Session replay is disabled in the website code. Heatmaps, exception capture, surveys and feature-flag requests are also disabled. Production analytics is restricted to the HTTPS marketing-site origin; local and preview sites do not send events to this project.
3. What the portal sets
| Name | Purpose | Lifetime |
|---|---|---|
__session | Your signed-in session, encrypted. | Session |
oidc_* | Short-lived state during single sign-on. | 10 minutes |
Both are strictly necessary. The portal does not run analytics, advertising or marketing cookies.
4. What we do not use
No advertising cookies. No cross-site tracking. No data broker or ad network receives anything from this site.
5. Turning them off
Use Cookie settings in the site footer or at the top of this cookie-policy page to accept or reject analytics. Choosing Reject after accepting withdraws consent, stops capture, aborts pending analytics transport and removes this site's PostHog identifiers. It does not erase events already received by PostHog; contact us below about data-rights requests.
We remember either choice for 180 days, then ask again. Withdrawal is shared with other open tabs on the same origin. If preference storage is unavailable, analytics remains disabled.
The expanded measurement scope introduced on 9 October requires fresh acceptance from visitors who accepted the earlier scope. Existing refusals remain honoured.
This site also honours Do Not Track when your browser sends it. It overrides acceptance and keeps analytics disabled. DNT is an additional safeguard, not a replacement for the consent choices above.
Every browser can block or delete cookies under its privacy settings. Blocking
strictly necessary portal cookies will break sign-in. Content blockers can also
block eu.i.posthog.com.
6. Changes
We publish changes to this policy on this page with a new effective date.