Cookies & Storage
Effective date: 13 May 2026
The short version
We use one essential login cookie, browser localStorage for your in-progress postcard draft, and cookieless analytics via PostHog. No advertising cookies. No consent banner, because nothing here requires one.
Cookies
A cookie is a small file stored in your browser. We set exactly one:
| Name | Set by | Purpose | Expires |
|---|---|---|---|
sb-* | Supabase (our auth system) | Keeps you logged in. Stores a secure session token (JWT) in an HTTP-only cookie so the server can recognise you between page loads. Only set if you create an account and sign in. | When you sign out, or after a defined inactivity period |
This cookie is strictly necessary for authentication — it is not used for tracking or advertising, and it is not set if you use the service as a guest. It falls under the exemption in § 25(2) TTDSG and does not require consent.
Browser localStorage
localStorage is similar to a cookie but stored entirely on your device and never sent to our servers automatically. We use it for two things:
| Key | Purpose | When it's cleared |
|---|---|---|
amora.cart.v1 | Saves your in-progress postcard (photo, message, recipients) so you can close the tab and continue later. This data never leaves your device until you submit an order. | When you complete or cancel your order, or clear your browser storage |
ph_* | PostHog analytics. Stores a pseudonymous session identifier so we can understand how people move through the site (e.g. how many complete the send flow). No personal information is stored. Data goes to PostHog EU cloud and is used only by us. | After 12 months, or when you clear your browser storage |
Analytics in detail
We use PostHog (EU cloud, hosted in Frankfurt) to understand how people use Amora.Cards. PostHog is configured with persistence: 'localStorage' — it sets no cookies. All data is stored in localStorage on your device and sent pseudonymously to PostHog's EU servers.
We collect things like:
- Which pages you visit and in what order
- Which step of the send flow you reach and where you stop
- Errors or crashes
- Browser type and rough location (country level, derived from IP, not stored)
We do not collect: names, email addresses, postcard content, recipient addresses, or any payment information through analytics. Analytics data is never sold or shared with advertisers.
Legal basis: Legitimate interests (Art. 6(1)(f) GDPR). The data is pseudonymous, first-party only, and used solely to improve the service.
What we do not use
- Google Analytics or any Google tracking tags
- Meta Pixel or any social media tracking
- Advertising or retargeting cookies
- Cross-site tracking of any kind
Opting out of analytics
You can stop PostHog from collecting data about your session by opening your browser's developer tools, going to Application → Local Storage, and deleting any keys starting with ph_. PostHog will assign a new anonymous session on your next visit but will not link it to your previous one.
You can also use a browser extension like uBlock Origin, which blocks PostHog requests by default.
Third-party scripts
The only third-party script loaded on this site is PostHog, proxied through our own domain (/ingest) so it is not blocked by ad blockers by default. No other third-party scripts, pixels, or iframes are loaded.
Questions
If you have questions about how we use storage or analytics, email help@amora.cards or read our full Privacy Policy.