Cookie Policy
Recent Changes
Table of Contents
Click any section to jump directly to it
1. What this covers
This policy covers cookies and equivalent technologies — browser localStorage, and scripts loaded from other companies that can set their own identifiers. We group them into four categories. Only Necessary runs without your permission.
Nothing in the Preferences, Analytics or Advertising categories is loaded until you choose it. If you have not made a choice, or you chose Reject All, the third-party scripts are never requested at all — this is enforced in code, not only by a consent signal sent to the provider.
Which technologies run where. This policy covers both alphahouse.ai, the marketing pages, and app.alphahouse.ai, the application. Google Analytics 4, Google Tag Manager and the Tawk.to live-chat widget run on both. PostHog runs only on the application, so the marketing pages never load it, whatever you consent to. The tables below list the widest set that can load, not what will load on the page you are reading. Your choice is stored per site, so you will be asked once on each.
Honest note about the past: until 1 August 2026, Google Tag Manager and Google Analytics 4 were embedded directly in the site's HTML and ran on every page load before any consent was given. A default “denied” signal meant they should not have written cookies, but the scripts were loaded and contacted Google regardless. That has been removed.
2. Necessary (always active)
Required to deliver a service you asked for. These do not require consent and cannot be switched off.
| Name | Provider | Purpose | Duration | Set by |
|---|---|---|---|---|
| sb-<project-ref>-auth-token | AlphaHouse (via Supabase) | Keeps you signed in and authorises requests to your own data. | Session + refresh window (set by Supabase; typically 1 hour access token with a longer-lived refresh token) | First party |
| ah_cookie_consent | AlphaHouse | Stores your cookie choices and the policy version they were made against, so we do not ask again and do not load anything you declined. Browser localStorage, not a cookie. | Until you clear it or the cookie policy version changes | First party |
| ah_consent_subject | AlphaHouse | A random identifier used only to link your consent records together, so we can evidence a change of mind. Not used for analytics or personalisation. Browser localStorage. | Until you clear your browser storage | First party |
| ah_campaign_attribution | AlphaHouse | Remembers which campaign link (the utm_ labels in the address) brought you here, and the page you landed on, so we can tell which of our posts lead to sign-ups. It holds no identifier of you and is not sent to any other company from your browser. Browser localStorage. | 30 days from the campaign visit, or until you clear your browser storage | First party |
Our hosting and security providers (Vercel, Supabase, and any CDN in front of them) may also set short-lived operational cookies for load balancing and abuse prevention. These are strictly necessary and are not used to profile you.
3. Preferences (optional)
Optional features and remembered settings. We classify live chat here rather than as necessary: the site works without it, and support is also reachable by email.
| Name | Provider | Purpose | Duration | Set by |
|---|---|---|---|---|
| twk_uuid_<property-id>, twk_idm_key, TawkConnectionTime, twk_token_<property-id> (localStorage) | tawk.to Ltd. | Runs the live-chat widget: identifies your chat session so a conversation survives a page change. If you are signed in, your name, email and user id are passed to Tawk.to. | Session to 6 months, set by Tawk.to | Third party |
4. Analytics (optional)
Helps us see which pages are used and where people get stuck. Google Analytics and PostHog both process data in the United States — see the international transfers section of the Privacy Policy.
| Name | Provider | Purpose | Duration | Set by |
|---|---|---|---|---|
| _ga | Google LLC (Google Analytics 4) | Distinguishes one browser from another so visits can be counted. | 2 years (set by Google) | Third party |
| _ga_<container-id> | Google LLC (Google Analytics 4) | Maintains analytics session state. | 2 years (set by Google) | Third party |
| _gid | Google LLC | Distinguishes browsers over a short window. | 24 hours (set by Google) | Third party |
| _gat / _gat_gtag_* | Google LLC | Throttles the rate of requests to Google Analytics. | 1 minute (set by Google) | Third party |
| ph_alpha_house_ph (cookie and localStorage) | PostHog Inc. (US cloud) | Product analytics, feature flags and A/B test assignment: holds a pseudonymous identifier and feature-flag state. Session recording and autocapture are switched off in our configuration. | 1 year (set by PostHog). Deleted by us as soon as Analytics consent is absent. | Third party |
Google Tag Manager itself does not set cookies, but it is a container that loads other tags — and we cannot see inside it from your browser. Ours loads Google Analytics, so we treat the container as an Analytics technology and load it only when you accept Analytics. Google Consent Mode is additionally set to denied by default in every case.
5. Advertising (optional)
We do not currently run any advertising, remarketing or conversion pixel. There is no Meta pixel, no LinkedIn Insight tag, no TikTok or X pixel, and no Google Ads remarketing tag on this site.
The category exists so that if one is ever added it cannot load without your prior consent, and so that a Global Privacy Control signal has something concrete to switch off. If your browser sends Global Privacy Control, this category is locked off and we treat it as an opt-out of any sale or sharing of your personal information.
Because nothing in this category is active, accepting Advertising on its own currently loads nothing at all. We would rather tell you that plainly than load an analytics container under an advertising heading.
6. Other third-party requests
Google Fonts. Our pages currently load fonts from fonts.googleapis.com and fonts.gstatic.com. This does not set a cookie, but it does disclose your IP address to Google in order to serve the font file, and it happens before you make a cookie choice because the site cannot render without a typeface. Some European courts have treated embedding Google Fonts in this way as a personal-data disclosure requiring a legal basis. We are flagging this openly rather than omitting it; self-hosting the font files removes the issue and is a change we intend to make.
Stripe. When you go through checkout, Stripe sets its own cookies on its payment pages for fraud prevention. These are necessary to take a payment you have asked to make.
7. Managing or withdrawing your choice
Use the Cookie Settings link in the footer of any page, or here:
Withdrawing is as easy as giving consent, and takes effect immediately for anything not yet loaded. A script already running in the current tab cannot be un-run — we stop it capturing and delete the identifiers we can reach, and a page refresh clears the rest. Your browser's own settings can also block or delete cookies, and Google offers a Google Analytics opt-out add-on.
We keep a record of each choice — the date, the categories, the policy version shown, whether a Global Privacy Control signal was present, and the country your request came from where our provider tells us. We keep these records for 3 years so we can evidence your choice, then delete them.
If you have questions about this document, please contact us at privacy@alphahouse.ai
Document maintained and updated by AlphaHouse