This cookie notice explains how Simvictus (“we,” “us,” or “our”) uses cookies and similar technologies when you visit simvictus.com, and the choices available to you. It should be read alongside our Privacy Policy, which describes how we handle personal data more generally.
SUMMARY OF KEY POINTS
We use very few cookies. The ones we set by default are strictly necessary to sign you in and to protect forms against cross-site request forgery. Nothing used for analytics, heatmaps or session replay runs until you opt in.
Analytics are off until you accept them. Our consent banner defaults to decline. If you take no action, no analytics or session-replay technology loads at all — the scripts are not requested, not merely disabled.
You can change your mind at any time. The “Cookie settings” link in the footer of every page reopens the banner, and withdrawing consent is exactly as easy as giving it.
WHAT COOKIES ARE
Cookies are small text files placed on your device when you visit a website.
Some are required for the site to function; others are optional and used to
understand how a site is used. Alongside cookies, sites can store information in
your browser using related technologies such as localStorage. Where this
notice says “cookies”, it means both unless stated otherwise.
STRICTLY NECESSARY — SET WITHOUT CONSENT
These are required for the service to work and cannot be switched off. Under the ePrivacy Directive and GDPR they do not require consent, because without them functionality you have asked for would not operate.
| Name | Type | Purpose | Retention |
|---|---|---|---|
accessToken | Cookie (httpOnly) | Keeps you signed in between requests | 15 minutes |
refreshToken | Cookie (httpOnly) | Issues a new access token so you are not signed out mid-session | 7 days |
__csrf | Cookie | Cross-site request forgery protection, using a double-submit token checked against the x-csrf-token header | Session |
sv-consent | localStorage | Records your own cookie choice so the banner is not shown repeatedly | Until you clear it |
accessToken and refreshToken are httpOnly, meaning they cannot be read by
JavaScript running in the page. sv-consent is deliberately stored in
localStorage rather than a cookie so that recording your refusal does not
itself require setting a cookie.
ANALYTICS — ONLY AFTER YOU OPT IN
The following load only once you accept analytics in the consent banner. Until then they are not initialised and no request is made to their servers.
| Provider | Purpose | Notes |
|---|---|---|
| PostHog | Product analytics, funnels and heatmaps | Hosted in the EU. Requests are proxied through our own domain at /ingest |
| Microsoft Clarity | Supplementary heatmaps and session replay | Loaded only on consent |
| Sentry Session Replay | Reproducing errors as they appeared to you | Error reporting itself runs without replay; the replay component is added only on consent |
If you decline, PostHog is held in an opted-out state with in-memory storage only, and the Clarity and Sentry-replay components are never added to the page.
WHAT WE DO NOT USE
We do not use advertising or cross-site tracking cookies, we do not sell or share personal information for behavioural advertising, and we do not operate an SMS marketing programme.
MANAGING YOUR CHOICES
Global Privacy Control. If your browser or a browser extension sends a Global Privacy Control (GPC) signal, we honour it automatically: analytics stays off, none of the tools in the table above are loaded, and we do not show you the consent banner — you have already told us your preference. If you would rather enable analytics on this site despite the signal, open Cookie settings and accept; that override applies to this site only and does not change what your browser sends anywhere else.
On this site. Use the Cookie settings link in the footer of any page. It reopens the consent banner, where you can grant or withdraw analytics consent. The change takes effect immediately.
In your browser. You can block or delete cookies through your browser settings. Blocking strictly-necessary cookies will prevent you from signing in and may stop forms from submitting.
CHANGES TO THIS NOTICE
We may update this notice to reflect changes to the technologies we use or to legal requirements. Material changes will be reflected on this page.
CONTACT
Questions about this notice can be sent to info@simvictus.com.