Cookie Policy

1. Cookies and similar technologies

Cookies are small text files sites store in your browser. We also use browser local storage for login state and preferences—functionally similar to cookies for privacy choices. Together we refer to these as "technologies" in this policy.

The PostShuttle Service is owned and developed by Kestrel10 Limited. In this policy, "we" means Kestrel10 Limited as operator of the Service. PostShuttle uses essential technologies so the app can authenticate you and remember your cookie choice. If you click Accept analytics on the banner, we may load optional error/performance telemetry (the Sentry browser SDK) that can set its own cookies or identifiers. If you choose Essential only, that optional telemetry stays off. Error monitoring on our own servers is a separate thing, sets nothing in your browser, and is not controlled by this banner — the Privacy Policy explains it in section 2.2. You can change or withdraw your choice at any time in section 5.2 below; the page reloads so the change applies immediately.

2. How we use these technologies

2.1 Essential

Required to operate PostShuttle, including:

• Storing your authenticated session in a secure HTTP-only cookie (postshuttle_session) so browser scripts cannot read session tokens
• Storing a CSRF token in a readable cookie (postshuttle_csrf) so the app can send safe mutating API requests
• Storing your cookie choice in local storage (cookie_consent_preference)
• Storing your light/dark theme choice in local storage (postshuttle-theme)
• Remembering that you have dismissed the PostAssist image-provider notice, in local storage (postassist.gemini-training-disclosure-dismissed)
• A short-lived session storage marker used to recover from a failed page load (ps_nav_recovery_at), cleared when you close the tab
• Security-related data Next.js or our host may set (for example routing)

We do not ask for consent before essential storage because the Service cannot work without it.

2.2 Optional analytics / telemetry

If you choose Accept analytics, we enable the Sentry browser SDK to capture errors and performance data from your browser, and may load Google Tag Manager for usage analytics configured in our container. Those providers may use cookies or persistent identifiers under their own policies. Choosing Essential only keeps this disabled.

What this choice does not switch off is error monitoring on our servers, which runs whenever PostShuttle is running. Nothing is stored on your device by it and it cannot follow you to another website, so it is not a cookie question — but a report about a failed request can contain your IP address, and saying it was covered by this banner would be untrue.

2.3 Third parties on specific pages

hCaptcha may load on signup, login, or contact flows. It can set or read cookies or similar data on its domain to distinguish humans from bots. See hCaptcha’s documentation for details. Stripe may set cookies when you manage payment methods on billing pages. Social OAuth flows happen on each network’s site and are governed by that network’s policies.

3. Session vs persistent

Browser session cookies expire when you close the tab or browser. Persistent cookies or local storage entries remain until they expire, you clear site data, or you log out. Our authentication cookie persists until sign-out or server-side expiry.

First-party storage is set by the website origin that hosts PostShuttle (your browser will show the Service’s domain). Third-party cookies or scripts may appear when you opt into analytics, complete a captcha, pay with Stripe, or authorize a social network—each provider’s policy applies.

4. Storage keys and cookies (summary)

Timezone and profile data are stored on our servers with your account, not in this table. We update this page when we add materially new trackers.

5. Managing Your Cookie Preferences

You have the right to accept or reject cookies. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies if you prefer. However, this may prevent you from taking full advantage of the Service.

5.1 Browser Settings

You can control cookies through your browser settings. Here are links to instructions for popular browsers:

• Google Chrome: Settings → Privacy and security → Cookies and other site data
• Mozilla Firefox: Options → Privacy & Security → Cookies and Site Data
• Safari: Preferences → Privacy → Cookies and website data
• Microsoft Edge: Settings → Privacy, search, and services → Cookies and site permissions

Please note that if you disable cookies, some features of the Service may not function properly or may be unavailable.

5.2 Your cookie choice

When you first visit, we ask: Essential only or Accept analytics. You can change that answer here, as often as you like, and withdrawing analytics consent takes exactly as many clicks as granting it. Clearing site data for the PostShuttle site also removes the choice, and we will ask again on your next visit.

5.3 Opt-Out Tools

You can also opt out of certain third-party cookies by visiting:

• All About Cookies - General cookie management information
• Your Online Choices - European Interactive Digital Advertising Alliance opt-out
• Network Advertising Initiative - NAI opt-out page

6. Impact of Disabling Cookies

If you choose to disable cookies, some features of the Service may not work as intended. Specifically:

• You may not be able to log in to your account
• Your preferences and settings may not be saved
• Some features may be unavailable or function incorrectly
• We may not be able to provide you with personalized content
• Security features may be compromised

We recommend that you leave cookies enabled to ensure the best experience with our Service.

7. Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) feature that signals to websites you visit that you do not want to have your online activity tracked. Currently, there is no standard for how DNT signals should be interpreted. As a result, our Service does not currently respond to DNT browser signals or mechanisms.

8. Third-party technologies

Depending on the page and your choices, third parties may include:

• Sentry—error monitoring: in your browser only with analytics consent, and on our servers at all times
• Google Tag Manager (optional analytics consent, when configured)—usage analytics
• Stripe—billing and payment methods
• hCaptcha—human verification on selected forms
• Social networks—when you start OAuth, their cookies and policies apply on their domains

We do not use third-party advertising cookies on the core app for profiling. Review each vendor’s policy for detail beyond what we control.

9. Updates to This Cookie Policy

We may update this Cookie Policy from time to time to reflect changes in our practices or for other operational, legal, or regulatory reasons. We will notify you of any material changes by:

• Posting the updated Cookie Policy on this page
• Updating the "Last updated" date
• Displaying a prominent notice on the Service
• Sending you an email notification (if you have provided an email address)

We encourage you to review this Cookie Policy periodically to stay informed about our use of cookies.

10. European Users (ePrivacy Directive)

If you are located in the European Union, the ePrivacy Directive requires us to obtain your consent before placing non-essential cookies on your device. We comply with this requirement by:

• Requesting your consent before placing non-essential cookies
• Providing clear information about the cookies we use
• Allowing you to withdraw your consent at any time
• Only placing essential cookies without consent (as they are necessary for the Service to function)

11. Contact Us

If you have any questions about our use of cookies or this Cookie Policy in connection with PostShuttle, contact us at: