Cookie Policy
Last Updated: 20 July 2026
This page lists everything Indiexa stores on your device, what each item is for, and how long it stays. It covers cookies and anything kept in your browser's local or session storage, since the rules treat them the same way. It also covers the things that leave your browser without being stored, because those matter to you even though the cookie rules do not reach them.
Where the honest answer is more awkward than the reassuring one, the honest answer is below. Two things in particular: the analytics SDK loads on every page even before you agree to anything, and our own view counter runs in your browser on product pages whether or not you agree to anything.
I. Necessary.
These keep you signed in, protect your account, and stop the market being manipulated. Indiexa does not work without them, so they cannot be switched off and we do not ask permission for them.
| Name | Type | Purpose | Retained | Set by |
|---|---|---|---|---|
| __Secure-indiexa.session_token | Cookie | Keeps you signed in. Set by our API when you log in and sent with every request afterwards. | 7 days, extended by a day whenever you use Indiexa | Indiexa |
| __Host-indiexa.x-csrf-token | Cookie | Half of the check that stops another site making requests using your session. Our API sets this and your browser sends it back; the matching half travels in a header that only Indiexa's own code can set. | 1 hour, renewed as you use the site | Indiexa |
| __Host-indiexa.csrf-binding | Cookie | Ties the check above to your browser when you are signed out. Only set for visitors without an account or a session. | 1 hour, renewed as you use the site | Indiexa |
| __Secure-indiexa.two_factor | Cookie | Marks that you are part-way through a two-factor check. Only set if you have two-factor turned on, and only between entering your password and entering your code. | 10 minutes | Indiexa |
| __Secure-indiexa.trust_device | Cookie | Set only if you tick 'trust this device' during a two-factor check, so we stop asking for a code on this browser. | 30 days | Indiexa |
| __Secure-indiexa.state | Cookie | A short-lived value that lets us confirm a sign-in with Google, GitHub, Apple or X came back to us from the same browser that started it. Only set while you are being redirected. | 5 minutes | Indiexa |
| routingHint | Cookie | A signed token holding your user ID, plan, username and whether your email and two-factor are set up, so pages render correctly without an extra request. It is signed rather than encrypted, so anyone holding it can read those fields. Note that signing out does not clear it; it stays until it expires or you sign in again. | 7 days | Indiexa |
| indiexa:client-identity | Local storage | Two random IDs, one for this device and one anonymous, sent with most requests to our API. Sign-in and sign-up requests carry only the anonymous one, and the view-counting message in section V carries neither. Used to verify requests come from the real Indiexa app and to detect market manipulation from a single device. They are not used to profile you. If you submit the pitch, sponsor or support form, they are saved alongside that submission so we can tell repeat submissions apart, and are kept for as long as we keep the submission itself. | Until you clear site data | Indiexa |
| indiexa-consent | Local storage | Your choices on this page, when you made them, and whether they came from a browser privacy signal rather than the banner. | Until you clear site data | Indiexa |
| __ph_opt_in_out_* | Local storage | PostHog's own record of whether you allowed analytics. Written on your first page load, before you have answered anything, because 'not agreed' is itself the thing it records, and updated when you answer. | Until you clear site data | PostHog |
| indiexa_pending_checkout | Session storage | Remembers which plan you picked while you sign in, so checkout resumes where you left off. | Until you close the tab | Indiexa |
| ApplicationStore | Local storage | Holds your user ID, username, avatar and whether you are a founder while you are signed in, so the site appears logged in straight away instead of blank while we check your session. The key itself exists as soon as you open Indiexa; while you are signed out it is present but empty. | Emptied when you sign out; the key remains until you clear site data | Indiexa |
| indiexa.onboarding | Cookie | Records whether you have finished setting up your profile, so we can take you to the setup page immediately instead of loading a page you would only be moved off. Holds nothing but that one yes-or-no answer. | 7 days, or until you sign out | Indiexa |
Several of these appear only in specific situations. The two-factor cookies exist only if you use two-factor, and only during a check. __Secure-indiexa.state exists only during the few seconds you are being redirected to Google, GitHub, Apple or X. __Host-indiexa.csrf-binding is set only for signed-out visitors. If none of those apply to you, none of them are on your device.
The names above are the ones your browser will show. The __Secure- and __Host- prefixes are part of the actual cookie names, not decoration; they are instructions to your browser to refuse the cookie unless it arrived over HTTPS.
II. Functional.
These remember choices you have already made, like your theme and font. They are on by default because storing a setting you picked is part of doing what you asked, but you can turn them off. If you do, we delete both of the items below straight away and stop writing your font and motion preferences.
| Name | Type | Purpose | Retained | Set by |
|---|---|---|---|---|
| theme | Local storage | Remembers whether you chose light or dark. | Until you clear site data | Indiexa |
| indiexa-preferences | Local storage | Remembers your font choice and whether you asked for reduced motion. | Until you clear site data | Indiexa |
One caveat on the theme. It is stored by a library that writes to your browser directly rather than through our consent gate, so if you turn functional storage off and then pick a theme again, the theme will be stored again. Turning functional storage off does not stop you choosing a theme; it stops us keeping the choice unless you make it again.
III. Analytics.
These tell us which pages and features get used so we know what to build next. They are off until you turn them on, and no analytics event is sent before you agree.
| Name | Type | Purpose | Retained | Set by |
|---|---|---|---|---|
| ph_*_posthog | Cookie | Identifies your browser across visits so we can count visitors and see which features get used. | 365 days | PostHog |
| ph_*_posthog | Local storage | The same analytics identifier, kept in step across open tabs. | Until you clear site data | PostHog |
| _ph_pre_logout_anon_id | Session storage | Written when you sign out, so that if you sign back in in the same tab your earlier activity joins up with your account instead of counting twice. This one is written whether or not you allowed analytics; if you refused, the value is a random ID that was never sent anywhere. | Until you close the tab, or until you sign in again | PostHog |
| ph_*_posthog | Session storage | The part of the analytics identifier that belongs to this tab, kept separately from the copy that lasts across visits. | Until you close the tab | PostHog |
| ph_*_window_id | Session storage | Identifies this browser tab, so activity can be grouped by tab within one visit. | Until you close the tab | PostHog |
| ph_*_primary_window_exists | Session storage | Records whether this tab was newly opened or simply reloaded, so refreshing a page does not look like a new visit. | Until you close the tab | PostHog |
One item in that table is written even if you refuse: _ph_pre_logout_anon_id, which is written when you sign out. If you refused analytics, the value it holds is a random ID that was never sent anywhere. Everything else above is written only after you agree.
The PostHog SDK itself does load on every page, before you have agreed to anything. It is loaded in an opted-out state, so it writes none of the above and sends no events, but it does download its configuration and a few of its own script files as it starts. Those downloads come from indiexa.com, not from PostHog. We load it up front rather than on demand because an SDK that is only loaded after you agree cannot then act on a choice you make later in the same visit, which is what PostHog's own guidance recommends against. We would rather tell you it is there than describe it as absent.
If you turn analytics off after having turned it on, the ph_*_posthog cookie and both its local storage and session storage copies are deleted immediately. Two per-tab items, ph_*_window_id and ph_*_primary_window_exists, are not deleted; they go when you close the tab. __ph_opt_in_out_* stays on purpose, because it is the record of your refusal.
IV. Session replay.
On two pages, /getting-started and /pricing, we can replay how a visit went so we can find where people get stuck. It is off unless you turn it on and it never runs anywhere else on the site.
Session replay needs analytics to be on as well. PostHog offers no way to record a session while analytics is off, so the replay switch is disabled until analytics is on, and turning analytics off turns replay off with it. We would rather grey the switch out than let you turn on something that silently does nothing.
What you type is masked in your browser before anything is sent, so we never receive the contents of form fields, and passwords are never captured. We also mask all visible page text, not just form fields. Session replay does not store anything extra on your device; it uses the same PostHog identifiers listed under Analytics above.
V. Counting views on product pages.
This section describes something the consent banner does not cover, so it is worth reading even if you have refused everything.
When you open a product page, a chart, or a product's forum, or click through to a product's website, your browser sends a short message to our API saying which product it was and which of those things you did. It records five kinds of event: a page view, a chart visit, a forum visit, an outbound click, and an engagement. It stores nothing on your device, and it is the only measurement on Indiexa that runs whether or not you have agreed to anything.
Your browser does attach your session cookie to that message, because it goes to our own API and browsers attach it to everything. Our API does not read it. The endpoint never resolves who you are; it treats every message as anonymous, including yours when you are signed in.
Instead of an identity, it works out a one-way fingerprint from your IP address and browser details, scrambled with a secret key. Your IP address and the fingerprint are used and discarded in memory. Neither is ever stored. What we keep is counts and nothing else: how many distinct viewers a product had in a given hour, day and week, held for 48 hours, 14 days and 14 days respectively.
The key changes on a timer, so the fingerprint stops matching after it rotates. For the hourly and daily counts it changes at midnight UTC, so you are not recognisable as the same viewer across two days. For the weekly count a separate key runs from Monday to Monday, so within a single week you are recognisable as the same viewer, without us knowing who that viewer is.
Repeat visits inside a bucket are collapsed, so opening the same product five times in an hour counts once for that hour. Product owners see counts, never who viewed their page.
We count this without asking because it stores nothing on your device, which is what the cookie rules govern. If you would rather it did not happen at all, we do not currently offer a switch for it.
VI. Who else is involved.
We run no advertising, no retargeting, and no marketing trackers of any kind. We do not sell or share your data with data brokers, and nothing on Indiexa is funded by tracking you. These are the outside parties your browser actually contacts:
- PostHog. Product analytics and session replay. All of it, including the SDK download and session replay data, is routed through indiexa.com rather than sent to PostHog directly, so in normal use your browser does not contact a PostHog domain at all. The one exception is PostHog's own authoring toolbar, which only our team can launch and which talks to PostHog directly when it runs.
- Cloudflare. Two separate things. Turnstile is the bot check described in section VII. R2 is where avatars, product logos and post images are stored. Most images on Indiexa are fetched from R2 by our own server and passed on to you, in which case Cloudflare sees our server rather than you; some, noted below, your browser fetches directly.
- Polar. Payments. You are redirected to Polar's own checkout and nothing from Polar runs on the page while you browse Indiexa.
- Google, GitHub and X. If someone signed up with one of these and never replaced their picture, their avatar stays hosted by that provider rather than by us. On most pages our server fetches it and the provider sees only our server. In a few places, including the whale leaderboard, take authors and the sign-up page, your browser fetches it directly, and there the provider receives your IP address and the page you were on, whether or not you have an account. Apple does not provide a picture, so no Apple-hosted avatars exist.
- Google, GitHub, Apple and X. If you choose to sign in with one of these, you are sent to them and they learn that you are signing in to Indiexa. This only happens if you pick that option.
Indiexa's own API runs on a separate address, api.indiexa.com. It is us, not a third party, but your browser does treat it as a separate origin and sends your session cookie to it.
VII. The bot check.
We use Cloudflare Turnstile to tell real people apart from automated abuse. It loads on the pages holding these forms, and nowhere else: sign in, sign up, forgotten password, resetting a password, magic-link sign in, and the pitch, sponsor and support forms.
The Turnstile script loads when the page opens rather than when you press submit, so Cloudflare receives your IP address and your browser details at that point. On the sign-in, sign-up, forgotten-password, password-reset and magic-link forms the check itself also runs then. On the pitch, sponsor and support forms it runs only once you submit, which is when Cloudflare learns which form it was. It never receives anything you typed into the form. Any storage Turnstile uses sits on Cloudflare's own domain, not on indiexa.com, so it does not appear in the tables above.
VIII. Browser privacy signals.
If your browser sends a Global Privacy Control signal, we treat it as a refusal of everything that is refusable. You will not see a consent banner, and functional storage, analytics and session replay are all left off. Only the necessary items in section I are stored. If you would like your theme and font remembered after all, turn functional storage back on in cookie settings; an explicit choice you make yourself overrides the signal.
One limit worth being straight about: we read the signal in your browser rather than from the request header, so it takes effect once the page has loaded rather than before it is served.
IX. Changing your mind.
You can change or withdraw any of these choices at any time, from cookie settings at the top of this page or from the "Cookie settings" link in the footer of every page. Turning functional storage off deletes what it stored immediately. Turning analytics off deletes the analytics cookie and both its local and session storage copies immediately, and the two remaining per-tab items go when you close the tab.
X. Questions.
For how we handle personal data more generally, see our Privacy Policy. If something here is unclear or looks wrong, tell us through our support page and we will fix the page or the behaviour, whichever turns out to be at fault.