Cookie Notice

1. How we use browser storage

RD Study Lab uses browser storage that is necessary to run the product. PostHog also uses local storage for account-linked product analytics when you sign in without declining analytics, and uses local storage plus privacy-masked session replay if you select Accept analytics. Browser storage includes cookies, local storage, and similar technologies. Separately, we run limited cookieless usage measurement that sets no cookies and uses no browser storage, described in section 5.

2. Essential cookies and first-party service and security logs

We use authentication and session cookies through Supabase so you can sign in, stay signed in, and access protected parts of the app securely.

Our servers also keep essential first-party logs whenever you use the app, because they are needed to run the service, keep accounts secure, and prevent abuse and account sharing. These logs can include your internal account identifier, the action performed with its time and page path, the IP address and browser user-agent of the request, and a stable device identifier with related device and browser characteristics used to recognize the devices on your account.

This essential processing is necessary to provide the service. It is not browser analytics, it is not controlled by the optional PostHog analytics choice below, and it stays active while you use RD Study Lab. Our Privacy Policy describes these essential logs and their purposes in more detail.

3. Functional storage on your device

The site uses local storage for product functionality such as remembering your theme preference and saving in-progress review session state on your device so you can resume where you left off.

4. Payments and third-party pages

Payments are handled through Stripe. When you move to a Stripe-hosted checkout or other Stripe-managed page, Stripe may use its own cookies, logs, and security technologies under its own terms and privacy notices.

5. PostHog analytics: cookieless by default, additional analytics with consent

For every visitor, including before any choice and after declining, we run PostHog in cookieless mode to measure limited usage such as page visits, referrers, campaign tags, and device and browser characteristics. Cookieless mode sets no cookies and uses no local storage. PostHog assigns a rotating identifier derived from limited request information and does not create a person profile for these events. The network request can still involve an IP address and browser information, so we do not describe this data as necessarily anonymous under every privacy law.

After sign-in, if you have not declined analytics, PostHog uses local storage and identifies product events using your internal account identifier and email address. We use the email to maintain the signed-in analytics profile and help distinguish internal and test accounts; it is not used for advertising. If you accept analytics, PostHog also uses local storage across visits and enables privacy-masked session replay.

Session replay, which lets us reproduce usability problems, runs only after you accept analytics, never in the cookieless tier. RD Study Lab masks all form inputs, page text, and element attributes before replay data is sent. We do not use PostHog for advertising or cross-site behavioural targeting.

6. Consent

Limited cookieless measurement runs for signed-out visitors regardless of their choice and does not create a PostHog person profile. When you sign in, we identify product events to your account using your internal account identifier and email address and use local storage unless you have declined analytics. Session replay is activated only after you select Accept analytics. Declining does not prevent you from using RD Study Lab, and you can change or withdraw your choice below at any time.

7. Your controls

You can also manage cookies and local storage through your browser settings. Blocking necessary storage may stop sign-in, checkout, and other core features from working correctly. Clearing site data will reset your saved analytics choice.

8. Processing by PostHog

PostHog is our analytics service provider. We currently use its United States cloud region, so analytics data may be processed in the United States. PostHog applies its own security and privacy commitments as our service provider. Read PostHog’s privacy notice.

9. More information

For more about how we handle personal information, see our Privacy Policy.

Revision history

• September 8, 2026: Clarified cookieless identifiers, account-linked analytics, email disclosure, and United States processing.
• July 19, 2026: Clarified that anonymous, cookieless analytics run for all visitors, while cookies, session replay, and account-linked analytics require consent.
• July 11, 2026: Current version published.