Cookies
Last updated: 2026-11-03
What are cookies and similar technologies?
Cookies are small text files placed on your device. We also use similar technologies that store data in your browser in the same way: localStorage, sessionStorage, IndexedDB, and the offline cache used by the installable app. We treat all of these under the same rules, and this policy applies to them equally.
We use them to keep you signed in, remember your preferences, let the app work offline, and — only with your permission — to understand how our marketing site is used.
The examples below are illustrative rather than a complete list of every stored item. If you want a full inventory of what Fixray stores on your device, email hello@fixray.app and we’ll send you one.
Categories we use
| Category | Purpose | Examples | Consent |
|---|---|---|---|
| Essential | Keeping you signed in, keeping your account secure, and remembering your cookie choice | Your sign-in session (localStorage); your cookie choice (fixray.consent.v1, kept until you change it); the consent banner’s own cookie (fixray_cc_unused); Cloudflare Turnstile, which checks that form submissions come from a person rather than a bot | Always on |
| Functional | Remembering your preferences and in-progress work, and letting the app keep working when you lose signal | Light/dark and branding theme (fx-theme-cache, gs-theme); an unfinished issue report you started (fx-report-draft); which site and organisation you last had open; your recent searches; how you like the issue list laid out (fx-issues-view); dismissing prompts such as “install the app”. In IndexedDB we also hold issue reports you submitted while offline — including any photos and voice notes attached to them — until they can be sent, plus a cache of your recent issues and settings so the app opens quickly. | Always on |
| Analytics | Understand which pages work and what to fix | PostHog — a cookie plus localStorage and sessionStorage entries named ph_*; the cookie is kept for up to 1 year and the sessionStorage entries end when you close the tab. Also Cloudflare Web Analytics, which sets no cookie, stores nothing on your device and runs before you choose (see Performance and error monitoring). If you turn Analytics off after allowing it, PostHog keeps a record of that choice (__ph_opt_in_out_…), because it is how we remember not to track you. | Opt-in. In the UK, cookie-free counting runs unless you object: see Performance and error monitoring |
| Sales and marketing | Recognise which company you’re visiting from, and recognise you by name if you’ve been in touch with us or sent us a form, so we can follow up about Fixray. Also needed for the HubSpot booking calendar | HubSpot (hubspotutk and __hstc, kept for 6 months; __hssc, 30 minutes; __hssrc, until you close your browser; messagesUtk), which recognises repeat visitors and contacts and may also record what you submit through forms on our marketing site; and Apollo — localStorage entries (apolloAnonId, …_eventQueue) used to recognise which companies visit, for our sales outreach. We clear both if you withdraw sales and marketing consent. | Opt-in |
Booking a demo
Our booking page (/book-demo) and the booking panel on our home page show a calendar provided by HubSpot, embedded from meetings-eu1.hubspot.com. If you have allowed sales and marketing cookies, it loads straight away. If you haven’t answered the cookie banner yet, you see a button instead: “Load HubSpot’s booking calendar (sets HubSpot cookies)”. Nothing is requested from HubSpot until you press it. Pressing it loads the calendar until you close it or leave the page: we don’t store it as a cookie choice, it doesn’t switch on our own analytics, and the next time the calendar is shown, we ask again.
Inside that embedded calendar, HubSpot sets its own analytics cookies (hubspotutk, __hstc, __hssc, __hssrc), which it uses to recognise repeat visitors. To be precise about who sets what: these are third-party cookies stored against hubspot.com, not against fixray.app. We do not set them and — importantly — we cannot delete them for you. Clearing them is done through your browser’s own cookie settings for hubspot.com, or by blocking third-party cookies. HubSpot’s use of them is covered by HubSpot’s privacy policy.
If you decline sales and marketing cookies — on the banner, in preferences, or via a Global Privacy Control signal from your browser — the calendar is not loaded at all, so those cookies are never set in the first place, and you get a simple form instead that stores nothing on your device. If you decline after the calendar has already loaded, we remove the calendar, and we clear the HubSpot cookies that sit on fixray.app — but the ones HubSpot has already stored against hubspot.com are outside our reach and stay until you clear them in your browser. The same applies if you pressed the button and then decline: we remove the calendar, and the cookies HubSpot already stored against hubspot.com stay until you clear them in your browser.
So HubSpot sets no cookie through our site until you have chosen, either by allowing sales and marketing cookies or by pressing that button.
Performance and error monitoring
To keep fixray.app fast and available, our hosting provider Cloudflare measures traffic on its own servers, such as request counts and response times. No cookie is set for this and no user identifier is attached.
Our marketing pages (not the Fixray app) also load Cloudflare Web Analytics, a small script that counts visits and measures how fast each page loads. It sets no cookie and stores nothing on your device, but it reads technical details from your browser, such as page-load timings and your browser type and version. Each time a page loads, it sends Cloudflare the page’s address, without anything after the ?, and the site that linked you here. Cloudflare also receives your IP address, as it does for every request to our site. Cloudflare handles all of this on our behalf, only to help us improve our website. We see only totals, such as visits per page, per referring site and per country, never a record of you. On the first page you open, it loads when our cookie banner appears, before you have chosen. If you decline on that first page, the script can still send its report for that page when you leave it, but it won’t load on any page after. To turn it off, choose “Reject all”, switch off Analytics in preferences, or use a browser that sends a Global Privacy Control signal.
If you’re in the UK, our analytics provider PostHog also counts your visit to our marketing pages before you choose, without keeping anything on your device. It records the pages you view and the actions we measure on them, such as which button you pressed. It recognises a visit only by a code PostHog works out on its servers from your IP address and browser, and that code changes every day. It drops anything after the ? in the address, including campaign tags, and never links the count to you as a person. PostHog does this on our behalf, only to help us improve our website, and we see counts, not people. It starts when our cookie banner appears. To object, choose “Reject all”, save your preferences with Analytics off, or use a browser that sends a Global Privacy Control signal; we stop counting at once. We tell UK visitors apart by the time zone your device reports.
Separately, on every page load of our marketing site — not only when something goes wrong — we send a short diagnostic report to our analytics provider PostHog telling us whether the page loaded correctly. It contains the page path (without anything after the ?), how long the page took to become usable, whether the page was in view while it loaded (a page opened in a background tab can look slow when nobody is waiting on it), how the page was opened (a fresh visit, a reload, the back button, or a page your browser loaded ahead of time), whether your browser had paused it and brought it back, and any error encountered. We do not send your browser name, version or any device details — nothing that names your browser or your device. Where the page relies on a modern web feature to lay out correctly, the report says whether your browser supports that feature (a short list, empty for almost everyone), so that when something breaks we can tell whether it affects everyone or only older browsers. This report stores nothing on your device — the random reference it carries exists only for that single page load and is never saved, so it cannot be used to recognise you on a later visit. As with any request to an outside service, PostHog does receive your IP address and may work out approximate location or browser information from the request itself. This is what tells us the site has broken for real visitors, and it is recorded regardless of your cookie choice.
If a page fails, we send the technical details of that error to our error-monitoring provider Sentry so we can fix it. This stores nothing on your device and we do not record your session. Before a report leaves your browser we strip out email addresses, IP addresses and cookies. We also remove any email address, password, access token or API key that appears in the text of the error message itself, and in the record of the pages you moved through just before it. As with any request to an outside service, Sentry still sees your IP address from the connection.
None of this is used to build a profile of you or to target advertising. We treat the PostHog and Sentry reports as operational telemetry necessary to keep the service working.
Campaign attribution
If you arrive from an advert, email, or campaign link, that link carries tags identifying the campaign. If you opt in to analytics, we keep the campaign tags, the site that linked you here and the first page you opened, for the length of your visit (fx_utms and fx_first_touch, held in sessionStorage), and if you sign up we pass them to the Fixray app with your sign-up, so we can tell which campaign or site brought you here.
Withdrawing Analytics removes fx_utms and fx_first_touch from your browser at once. Details already passed with a sign-up are kept with your account, not with your visit.
If you decline, or you haven’t answered the banner yet, nothing is stored and the website passes nothing to the sign-up page: the tags stay in memory for that one page and are discarded as soon as you go anywhere else. The same applies to the marker we use to avoid counting the same signup twice (fx_signup_started) — it is only written once you have opted in.
Either way, the sign-up page itself records any campaign tags in its own address and the site that linked to it, and keeps them with your account.
The cookie-free count we make in the UK before you choose never carries campaign tags.
In-app product analytics
When you're signed in to the Fixray app (/app/*), we collect product analytics on the basis of our legitimate interests, to operate and improve the service. This tracking is cookieless — no analytics or tracking identifiers are written to your browser, and analytics data is held only in memory for the length of your visit. The essential and functional items listed above (such as your sign-in session and theme preference) still apply inside the app.
Global Privacy Control (GPC)
We honour the GPC signal automatically. If your browser sends GPC, we record a "reject all" decision on first visit and never show you the banner. You can still opt back in at any time.
Manage your choices
You can change your cookie preferences at any time:
Contact
Questions about cookies or your data? Email hello@fixray.app. For how we handle personal data more broadly, see our Privacy Policy.