XPloit

Cookie Policy

What cookies and local storage we use, and why.

Effective date

This Cookie Policy is effective as of July 25, 2026 and was last updated on July 25, 2026. It supersedes the version dated March 17, 2026.

What are cookies

Cookies are small text files that are stored on your device (computer, tablet, or mobile phone) when you visit a website. They are widely used to make websites work efficiently, provide information to site owners, and improve the user experience.

Local storage and session storage are similar browser technologies that allow websites to store data on your device. Unlike cookies, they are not sent to the server with every request.

Cookies and storage we use

Essential cookies (strictly necessary)

These cookies are required for the platform to function. They cannot be disabled without breaking core functionality.

Cookie / Storage	Provider	Purpose	Duration
`__clerk_*`	Clerk	Authentication session management, sign-in state	Session / persistent
`__client_uat`	Clerk	Authentication token refresh	Session
`xploit_analytics_optout`	XPloit	Remembers that you turned usage analytics off (local storage). Only written if you actually opt out	Until cleared

Analytics storage (not used in the EU, UK, EEA, or Switzerland)

We measure which features get used so we know what to build and fix. How we do that depends on where you are, which is why you are not being asked to click through a cookie banner:

In the EU, UK, EEA, and Switzerland: analytics runs in memory only. No cookie, no local storage, nothing written to your device. Your visit is counted, and the identifier is discarded when you close the tab, so you are not recognized on a later visit. Your IP address is dropped from these events.
Everywhere else: we set the first-party analytics storage in the table below, which lets us tell a returning visitor from a new one.
If we cannot tell where you are, we use the memory-only mode. The stricter option is always the fallback.

Either way there are no ads and no cross-site tracking, and you can switch analytics off completely in Settings under Privacy.

Cookie / Storage	Provider	Purpose	Duration
`ph_*`	PostHog	Product analytics: which pages and features get used, so we know what to build and fix. Includes a first-party identifier that links your visits together	Up to 12 months
Campaign attribution	XPloit	Records which link or campaign first brought you here (referring host only, never the full URL). Held in memory only in the EU, UK, EEA, and Switzerland	Until cleared

Functional local storage (necessary for features)

We use browser local storage to preserve your in-progress work and improve the user experience. This data stays on your device and is not sent to our servers.

Storage Key	Purpose	Duration
Review/chat state	Preserves hand review progress, chat history, and coaching interactions so you don't lose work if you refresh the page	Until cleared
Referral code	Stores referral code from sign-up link	Until sign-up
UI preferences	Theme, layout, and display preferences	Until cleared

What we do not use

We want to be clear about what we do not use:

No third-party advertising cookies. We do not serve ads or use advertising tracking pixels.
No cross-site tracking. We do not track your activity across other websites, and our analytics cookies are first-party only.
No social media tracking cookies. We do not embed social media trackers.
No session recording of normal browsing. Our error monitoring tool (Sentry) can capture a short replay of the moments around a crash so we can reproduce it, and it does not set cookies. It is not enabled for ordinary sessions.
No sale of cookie data. We do not sell any data collected through cookies or local storage to third parties.

Third-party cookies

Some cookies are set by third-party services that we use to operate XPloit:

Clerk (authentication): Sets cookies necessary for sign-in, session management, and security. See Clerk's Privacy Policy.
Stripe (payments): May set cookies when you interact with payment forms for fraud prevention and payment processing. See Stripe's Privacy Policy.
Vercel (hosting): May set cookies for load balancing and performance optimization. See Vercel's Privacy Policy.
PostHog (product analytics): Counts visits and feature usage. Sets a first-party cookie and local storage entry only outside the EU, UK, EEA, and Switzerland; in those regions it runs in memory and stores nothing. See PostHog's Privacy Policy.
Sentry (error monitoring): Captures crash and performance diagnostics. Does not set cookies. See Sentry's Privacy Policy.

Managing your cookies

You can control and manage cookies in several ways:

Turn analytics off: Settings → Privacy → turn off “Help improve XPloit.” This takes effect immediately, stops collection, and clears the analytics storage already on your device. There is nothing to un-consent to, because we never asked.
Browser settings: Most browsers allow you to view, manage, and delete cookies through their settings. Note that disabling essential cookies may prevent you from using XPloit.
Local storage: You can clear local storage through your browser's developer tools or settings. This will reset your in-progress work and preferences.

For instructions on managing cookies in your specific browser, visit your browser's help documentation.

Legal basis for cookies (EU/UK users)

Under the EU ePrivacy Directive and UK PECR:

Strictly necessary cookies: We use these without consent as they are essential for the platform to function (e.g., authentication, security).
Functional storage: Local storage used for preserving in-progress work is necessary for the service you requested (session recovery, chat state).
Analytics: An analytics cookie would not be exempt, which is exactly why we do not set one in your region. Because nothing is stored on or read from your device there, the consent rule is not engaged. The measurement itself is processed on the basis of our legitimate interest in understanding how our own product is used: it is first-party, it is not used for advertising, it is not combined with data from other sites, and you can object at any time by turning it off in Settings.

We do not use advertising or cross-site tracking cookies anywhere, so there is nothing in that category to consent to.

Changes to this policy

We may update this Cookie Policy from time to time. Material changes will be posted on this page with a new effective date. If we ever want to store something on your device that is not exempt in your region, we will ask for consent first rather than quietly widening what we set.

Contact us

If you have questions about our use of cookies, contact us at admin@xploitpoker.com.