Cookies
This site sets no advertising and no cross-site cookies. Five small cookies make signing in work. Two further things are genuinely optional, remembering how you found us and product analytics, and both are off until you turn them on. Every one of them is listed below.
Every cookie this site can set
| Name | What it is for | Lifetime & flags |
|---|---|---|
joa_session | Keeps you signed in after you click the link in your sign-in email. Without it you would be signed out on every page. | 30 days · HttpOnly · Secure · SameSite=Lax |
joa_next | Remembers the page you were heading to when you asked to sign in, so you land back there instead of the home page. Erased the moment you arrive. | 10 minutes · HttpOnly · Secure · SameSite=Lax |
joa_admin | The operator's own session for the admin dashboard. It is never set for customers. | 12 hours · HttpOnly · Secure · SameSite=Lax |
joa_consent | Records that you have seen the notice at the bottom of the page, so it does not follow you around the site. | 400 days · Secure · SameSite=Lax |
joa_consent_id | A random identifier, no name, no email, no account reference, that lets us show you the record of what you were told, and lets you withdraw it. | 400 days · Secure · SameSite=Lax |
ph_* (PostHog) | Product analytics. ONLY set if you turn on "Analytics (PostHog)" in the preferences below: it is what makes a visit today and a signup next week the same journey. Turn the service off and Klaro deletes these cookies. | about 1 year · Secure · SameSite=Lax · opt-in (off by default) |
HttpOnly means your browser will not let any script read it, including ours. Secure means it is never sent over plain HTTP. SameSite=Lax means it is not sent when another site links into ours.
Other browser storage (not a cookie)
Klaro (the notice at the bottom of the page) offers two genuinely optional toggles: “Remembering how you found us” and “Analytics (PostHog)”. Nothing below is written until you explicitly turn one on in Klaro's preferences, and you can turn it off there just as easily. When you do, Klaro deletes the ph_* entries for you.
| Key | What it is for | Lifetime & flags |
|---|---|---|
joa_signup_attribution_v1 | Signup attribution: first-party, only with your consent. Records which site sent you here, the page you landed on, and any campaign tags, so that if you later create a free API key we can attach it and understand which channels work. | 30 days · localStorage · first-party · opt-in (off by default) |
ph_* (PostHog) | The same analytics as the cookie above, kept in localStorage as well so it survives a cookie being cleared. Written only after you turn on "Analytics (PostHog)". | about 1 year · localStorage · opt-in (off by default) |
What this site does not set
- No advertising cookies, and no ad pixel of any kind. Nothing here is used to follow you to another site.
- No cross-site or third-party tracking cookies. Nothing on this page sets a cookie that another site can read.
- No fingerprinting, no session replay, no scroll or mouse tracking, no click or form-field capture.
- Two optional services, and only two: "Remembering how you found us" (a single localStorage item, first-touch referrer and campaign tags, up to 30 days) and "Analytics (PostHog)" (page views, with cookies, processed by PostHog on EU infrastructure). Both are off by default and both are listed in the tables above. Nothing either of them writes exists until you turn it on, and turning it off deletes it.
- Nothing at all is set until you do something. Load the ledger, read a listing, browse the pricing page: the server returns no Set-Cookie header and no analytics request is made. You can check that yourself with your browser's network tab, and we would rather you did.
Why the notice offers Accept all and Decline
- Because there are now two genuinely optional things, so those are two real, opposite outcomes, and they are one click each. Earlier versions of this page explained why the site showed no such buttons: at the time nothing optional existed, so both buttons would have been theatre. That is no longer true, and the notice was changed on 22 Oct 2026 to match.
- Under the ePrivacy Directive (art. 5(3)) consent is needed to store or read anything on your device unless it is strictly necessary to provide the service you asked for. Every cookie in the first table is in that exception: a session you asked for by signing in, a redirect you asked for by clicking sign in, a notice you asked to stop seeing. The two optional services are the exception to the exception, which is exactly why they are not bundled in and not pre-ticked.
- It is still not a blocking modal. There is nothing to withhold from you while you decide, so the page is never trapped behind it; the notice appears once and stops appearing when you answer it.
What is recorded when you dismiss the notice
- That a disclosure of this version was shown and acknowledged, the random identifier above, the page you were on, and your browser's language.
- A one-way hash of your IP address and of your user agent, kept so the record cannot be repudiated, and so that neither can be read back out.
- It is held by our own consent service on our own infrastructure, and it is append-only: we can add to it, and we cannot quietly rewrite it. That is the point of keeping it.
What the server records, cookie or no cookie
- Ordinary web server logs, request path, timestamp, and an IP address, kept to keep the service up and to stop abuse. This happens on every website you have ever visited and is not done with cookies.
- When you take an action on your account, sign in, subscribe to the newsletter, start a checkout, write to us, submit a listing, create or rotate an API key, we record that the action happened, against your email address. This is how the business runs; it is not browsing history, and nothing is recorded when you are only reading.
- Those event records are processed for us by PostHog, on their EU infrastructure. The full list of who processes what is on the privacy page.
- One thing that is NOT a cookie and is NOT a script, so it is not in the tables above: when you ask us to email you a sign-in link, the page you asked from records, server-side, from the request itself, the page you arrived on, the site that referred you and any campaign tags in the link. It is attached to the key you create so we know which channels actually work. It needs no cookie, it survives JavaScript being off, and it is the reason this page can say the site does not depend on consent for it: nothing is stored on your device. Ask us and we will show you or delete it.
Some listing fields are machine-generated, the AI disclosure says which. For everything else, see Privacy, or write to us.