Cookies

What we looked for

Vercel Web Analytics loads on every page and does not set a cookie: it counts page views only. Beyond that and the four below, the site does not load Plausible, PostHog, TikTok, or any other product-analytics script on visitors. Fonts are served with the site, not from a third-party font host that would set its own cookie. Plausible and PostHog appear in the product only as optional connections a founder can make to their own project; they are not trackers on underway.life.

Four cookies you can decline

Four things set a cookie in your browser. In the UK, the EU, the EEA and Switzerland they wait for you: they are set only after you press Allow in the bar at the foot of the page, and never if you press No thanks. Everywhere else they are set when the page loads, and No thanks stops them from that moment and on every visit after. Which of the two applies is worked out from the country your connection comes from, which we do not keep. Your answer is remembered on this device; clear the site’s data to be asked again.

• Google Analytics. Counts which pages are read, roughly where visitors are, and where they came from, so we can tell whether a piece of writing or a launch did anything. It also records the one event of starting your free trial. IP addresses are not stored, and nothing you record or write in the app passes through it. Google’s own use is set out in its privacy policy. Alongside it, and behind the same Allow, Google Tag Manager loads the tags that tell an advertising platform that a visit or a signup came from one of our ads. Tag Manager itself sets no cookie; each tag it carries is listed here when it is added.
• ChatGPT Ads pixel (OpenAI). Records that you visited, and the one event of starting your free trial. Nothing you record or write in the app passes through it. OpenAI’s own use is set out in its privacy policy.
• Meta pixel (Facebook). Records that you visited, including the free landing pages, and the moment you ask for a sign-in link and first sign in, so we can tell whether an ad on Facebook or Instagram brought you here. Our server also sends Meta the same page view, and the same signup when you ask for a sign-in link, with your IP address, your browser, Meta’s own cookie ids and, when you came from an ad, its click id. For a signup it adds your email address hashed, never the address itself, so Meta counts each once. To match a visit to the same browser we keep one random id in a cookie called _uw_xid for a year; it holds no personal detail and is removed on No thanks. It sends nothing after a No thanks, or before a yes where you are asked first. Nothing you record or write in the app passes through it. Meta’s own use is set out in its privacy policy.
• X pixel (X Ads). Records that you visited, a view of Pricing or How it works, that you started a free account, that you started checkout, and, as a hashed email, never the address itself, that the sign-in link was sent. A click id from an X ad (twclid) is kept so a later conversion can be matched. Nothing you record or write in the app passes through it. X’s own use is set out in its privacy policy.

Cookies we do set

These are strictly necessary to run the service you asked for. UK cookie rules do not require a banner for them.

• Which cookie bar you see. Holds “ask” or “notice”, the rule for where your connection comes from, so the page knows whether to wait for your Allow. Gone when you close the browser.
• Sign-in session. After you log in, Supabase keeps you signed in with a cookie on this site. Without it the app would forget you on every page.
• Short-lived OAuth state. Connecting GitHub, Google Calendar, YouTube, LinkedIn, X, Zoom or Whop, or signing in with Whop, sets a cookie for a few minutes so the return trip cannot be forged. It is not used to track you.

Looking around a real account

Looking around underway’s own account, without signing up, sets a cookie that says you are in the demo, so the app’s pages open without an account. What you change there is kept in your browser under its own name, apart from any account of your own, and all of it goes when you press Leave, open any other page of the site, or close the browser. To learn which parts people look at, the demo also gives your visit a random number with no meaning, never an email. In the UK, the EU, the EEA and Switzerland that number is kept only after you press Allow, and otherwise lasts until the page closes; elsewhere it is kept for 30 days, so a signup made after looking around can be linked to the visit.

A test of our free pages

Outside the UK, the EU, the EEA and Switzerland, the pages our ads link to come in two versions: one asks a few questions to set up your series before your email, the other asks for your email first. A cookie remembers which version your browser was given, for 30 days, so it does not change between visits. It holds only the word “flow” or “form”, and when you sign up we note which one you saw, to learn which version helps people get started. In the UK, the EU, the EEA and Switzerland it is never set, and everyone sees the email first.

Storage that is not a cookie

Most of what the diary keeps on the device is not a cookie at all. It is still strictly necessary for the product you asked for.

• Recordings you make. IndexedDB in the browser, or files on the phone, hold the video and audio after you press record. Clearing this site’s data or deleting the app removes them.
• Settings you chose. localStorage remembers the series name, brand, cadence and a few preferences so they survive a refresh. Answers you give while setting up your series before you sign up are kept there too, so you can pick up where you left off, and are cleared after seven days, when you start over, or once your account has them. sessionStorage holds a couple of in-progress choices and is gone when the tab closes.

What we do not set

No analytics or advertising cookies beyond the four above, never after a No thanks, and, in the UK, the EU, the EEA and Switzerland, only with your yes: there, a visitor who never signs in and never presses Allow leaves without a tracking cookie from us.

More on privacy

What we collect, the lawful bases, retention and your rights are on the privacy policy. The companies that process data are listed under subprocessors. Questions: hello@underway.life.