Cookie Policy
This policy explains what cookies we use, why we use them, and how you can control them. Analytics and marketing scripts load only with your explicit consent. Essential cookies — including Stripe's own fraud-prevention cookies at checkout and a first-party cookie that remembers a referral link you followed — are set without consent because the site cannot work correctly without them. Functional cookies are set when you actively change a preference.
Last updated: July 28, 2026
Essential
Always active. Required for login, security, and basic functionality.
Analytics
Only with your consent. Helps us understand usage patterns via Google Analytics and PostHog.
Functional
Only with your consent. Remembers your language and display preferences.
Cookies We Use
Required for the platform to function. These cannot be disabled.
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
| sb-*-auth-token | Supabase | Authentication session — keeps you logged in | Session / 1 year |
| sb-*-auth-token-code-verifier | Supabase | PKCE authentication flow security | Session |
| cookie_consent | Athly AI | Stores your cookie preferences | 13 months |
| athly_cookie_consent | Athly AI | Stores your cookie preferences (localStorage mirror) | 13 months |
| __stripe_mid | Stripe | Fraud prevention — set by Stripe payment processing | 1 year |
| __stripe_sid | Stripe | Fraud prevention — set by Stripe during checkout | 30 minutes |
| athly_ref | Athly AI | Remembers the referral code from a ?ref= link you followed, so the referring affiliate is credited. First-party only; not shared with any third party. Set on arrival, because it exists only if you deliberately followed a referral link | 60 days |
| athly_vid | Athly AI | A random id with no personal data in it, set only if you arrive on a referral link. Its only job is to stop one person reloading that link from being counted as many visitors in the affiliate’s statistics. Never linked to your account | 1 year |
| athly_agency | Athly AI | Applies your agency’s white-label branding when you arrive via an agency link | 1 year |
| gmail_oauth_state / outlook_oauth_state | Athly AI | CSRF protection while connecting Gmail or Outlook | 10 minutes |
| athly_impersonating / athly_admin_restore | Athly AI | Agency-admin support sessions only — tracks and safely reverses an admin viewing a member account | Session |
Advertising conversion tracking by third parties. These are only set after you consent to analytics cookies (there is no separate marketing toggle, so accepting analytics enables these too). Rejecting means the scripts never load.
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
| _fbp | Meta Pixel | Tracks page views and conversion events for advertising measurement | 90 days |
| _fbc | Meta Pixel | Tracks ad click attribution | 90 days |
Help us understand how visitors use the site. Only loaded after you consent.
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
| _ga | Google Analytics | Distinguishes unique users for analytics | 2 years |
| _ga_* | Google Analytics | Maintains session state for GA4 | 2 years |
| ph_* | PostHog | Product analytics — distinguishes unique users and sessions | 1 year |
Remember preferences you actively set. Because these only record a choice you made yourself (your language, your sidebar layout), they are set when you make that choice rather than waiting on the analytics toggle.
| Cookie Name | Provider | Purpose | Duration |
|---|---|---|---|
| NEXT_LOCALE | Athly AI | Stores your locale preference | 1 year |
| googtrans | Google Translate | Stores your target language. Only set for languages we do not translate ourselves; for our supported languages we clear it and never load the Google Translate script | Session |
| sidebar_state | Athly AI | Remembers whether the dashboard sidebar is expanded or collapsed | 7 days |
These load from a third-party server but do not set cookies of their own on athlyai.com.
| Script | Purpose | Consent |
|---|---|---|
| Google Identity Services | Powers the "Sign in with Google" popup. Loaded on all pages so the sign-in button in the navigation works; Google may set cookies on its own domain when you actually use the popup. | Essential (authentication) — loads without consent |
| Google Translate | Machine-translates the page for languages we do not yet translate ourselves. | Only loads for those languages; never loads for our supported languages |
How to Control Your Cookies
Our Cookie Banner
When you first visit our site, a cookie consent banner appears. You can accept all, reject all, or customize which categories to allow. You can change your preferences at any time using the button below or from the Privacy Center. The banner is shown on our public pages; it is not displayed inside the signed-in dashboard, so if you want to change your choice while signed in, use the button below.
Browser Settings
You can also control cookies through your browser settings. Most browsers allow you to block or delete cookies. Note that blocking essential cookies may prevent the platform from functioning properly.
Google Analytics Opt-Out
You can opt out of Google Analytics across all websites by installing the Google Analytics Opt-out Browser Add-on.
Our Commitments
- - We do not sell cookie data to third parties
- - Marketing scripts (Meta Pixel) only load after you give analytics consent
- - Analytics scripts (Google Analytics 4, PostHog) only load after you give consent
- - Session recordings (PostHog) mask all input fields
- - Cookie consent expires after 13 months (you will be asked again)
- - You can change your preferences at any time