Cookie Policy

The marketing pages use two analytics tools to understand traffic and improve PromptChief: self-hosted Matomo (on our own server) and PostHog for product analytics. PostHog runs on PostHog Cloud EU (Frankfurt, Germany) under a data-processing agreement — your data stays in the EU and is not sold on.

Both tools are only loaded after you click Accept all in the cookie banner. If you decline, they do not load at all. You can withdraw consent at any time by clearing your browser's localStorage.

When analytics are active, Matomo may set _pk_id (13 months) and _pk_ses (30 minutes) cookies, and PostHog may set a ph_*_posthog cookie (up to 12 months). IP addresses are always anonymised. Legal basis: Art. 6(1)(a) GDPR — your consent.

If you decline (or have not decided yet), PostHog still counts your visit — but cookielessly. In that mode it writes nothing to your device at all: no cookie, no localStorage, no sessionStorage. Visits are distinguished by a server-side daily rotating hash that cannot be reversed or linked back to you, and no profile is built. Because nothing is stored on or read from your device, § 25 TTDSG does not apply — the same reasoning as for Ahrefs above. Legal basis: Art. 6(1)(f) GDPR. Matomo and the Meta Pixel do not load at all in this case.

Session replay: if you accept, PostHog additionally records how your session unfolds — but only inside the logged-in app at /app/, never on these marketing pages. All input fields and text areas are masked, so the prompts you write are never captured. Recordings are deleted after 30 days.

We advertise PromptChief and need to measure whether those ads work, so the marketing pages also run Google Ads conversion tracking and the Meta (Facebook) Pixel. The Meta Pixel loads only after you accept. Google Ads works differently: its tag is present on every page, but it starts in the denied state of Google Consent Mode v2. While denied it sets no cookies and stores no advertising identifier on your device — TTDSG §25 is therefore not engaged — and ad-click identifiers are redacted. It transmits only anonymous, cookieless measurement pings to Google (including servers in the USA; Google is certified under the EU-US Data Privacy Framework). Legal basis while denied: Art. 6(1)(f) GDPR — our legitimate interest in measuring our own advertising. Only if you accept does it set advertising cookies such as _gcl_*, and Meta _fbp (both up to 90 days) — legal basis then: Art. 6(1)(a) GDPR, your consent.

We additionally use Ahrefs Web Analytics for aggregate traffic statistics. Ahrefs is cookieless — it sets no cookies, uses no localStorage and does no device fingerprinting — so it loads without requiring consent (TTDSG §25 does not apply). It is not active on embedded /embed/ pages. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in privacy-friendly reach measurement.