Cookie Policy

1. Introduction

This Cookie Policy explains how THEPA uses cookies and similar technologies on the Platform. It should be read with our Privacy Policy. Processing is governed primarily by POPIA.

See the Privacy Policy for the broader collection and use of personal information.

2. What these technologies are

Cookies are small files stored on your device. Similar technologies include localStorage, pixel tags, and scripts that third parties load in the browser. Some of these can be personal information under POPIA when they can reasonably be linked to you (for example an authenticated session cookie).

3. Essential authentication

After you sign in we set an HttpOnly session cookie named better-auth.session_token (prefixed __Secure- on HTTPS). SameSite=Lax, Secure on HTTPS, path /. Absolute lifetime 7 days, 24-hour rolling refresh, 5-minute cookie cache. This cookie is required to keep you signed in and is not controlled by the analytics banner.

Platform admin (admin.thepa.app) uses a separate HttpOnly cookie named thepa_admin_jwt, lifetime 1 hour, set after OAuth/PKCE with the auth host.

4. Analytics, advertising, and measurement

A cookie banner is shown to every visitor who has no unexpired stored choice. Country detection is not used to hide it from South African visitors or to limit it to the EEA.

Your choice is stored in localStorage under the key cookie-consent as { analytics, timestamp } and expires after 365 days. Accepting analytics dispatches analytics-consent-granted; declining dispatches analytics-consent-declined.

What actually loads

• After you accept analytics: Microsoft Clarity and Google Tag Manager. GTM may fire conversion events (sign_up, subscription_purchase, waitlist_join) used by Google Ads tags configured in the GTM container, not in this repository.
• Dashboard Google Analytics 4: loads only after analytics consent.
• Without waiting for the banner: Google Analytics 4 on the public website (www.thepa.app) whenever a measurement ID is configured; Vercel Analytics on public landing pages and on the production dashboard; Sentry error monitoring on instrumented apps.

If you decline analytics, Clarity and GTM do not initialise. Landing GA4, Vercel Analytics, and Sentry still load when configured. That split is how the product runs today; this policy describes it rather than claiming every non-essential script waits for accept.

5. Maps

We use Mapbox. The public homepage loads Mapbox static map images. The signed-in dashboard uses Mapbox GL for interactive maps and related geocoding/search. Mapbox may set its own cookies or local storage on those surfaces. Maps are used on both public and authenticated pages.

6. Error monitoring

Sentry is initialised on dashboard, landing, and other instrumented apps when a DSN is configured. It is not gated by the cookie banner. Browser session replay, when recorded on error, masks all text and blocks media. sendDefaultPii is false.

7. Local storage

• cookie-consent: your analytics banner choice and a timestamp.
• theme: light, dark, or system appearance.
• Product tour flags: whether the in-app tour was completed.
• Dashboard recents: after sign-in, recent record ids, titles, and URLs keyed by organisation. This is identifying within your organisation.

Sanity Studio (content editors only) may store its own UI preferences such as colour scheme.

8. Managing preferences

Use the cookie banner to accept or decline analytics. You can also clear site data in your browser. Blocking the essential session cookie will prevent sign-in.

Browser settings cannot currently disable landing GA4, Vercel Analytics, or Sentry independently of the banner, because those scripts do not wait for the banner.

9. Updates

We will update this page and the “Last updated” date when the technology list or consent behaviour changes.

10. Contact

Questions: support page.

11. Payments

Checkout for subscriptions and guest invoice pay is hosted by Polar. Polar may set its own cookies on polar.sh during that flow. THEPA does not set a separate marketing cookie for Polar.