Cookie Policy
Last updated: 15/09/2026
This Cookie Policy explains how Diglot OÜ (“Diglot”, “we”, “us”) uses cookies and similar technologies on diglot.ai, in our web editor, browser extensions, and other surfaces of the Service. It complements our Privacy Policy and the Terms of Service.
1. What cookies and similar technologies are
A cookie is a small text file that a website stores on your device when you visit it. Similar technologies — local storage, session storage, pixels, and SDK identifiers — work in comparable ways. We use the word “cookies” in this policy as a shorthand for all of them.
2. The categories we use
Cookies on our sites fall into four categories. Strictly necessary cookies are always on. Marketing / advertising cookies are off until you opt in, wherever you are. Analytics depends on where you are. In the European Economic Area (EEA), the United Kingdom and Switzerland, analytics cookies are off until you opt in; before you choose, we only collect cookieless measurement that does not identify you (see below). Everywhere else analytics cookies are on by default, and you can switch them off at any time (see section 4). You make or change these choices via the cookie banner or in Settings → Privacy → Cookies.
| Category | What it does | Default | Examples on Diglot |
|---|---|---|---|
| Strictly necessary | Core functions: signing in, keeping your session, security, load-balancing, fraud prevention at checkout | Always on | Supabase Auth session cookie, Cloudflare security cookies, Merchant-of-Record checkout session |
| Functional / preferences | Remember language, theme, dismissed dialogs | On (with notice) | UI language, theme, dismissed onboarding tips |
| Analytics | Understand which features are used and where users get stuck — to improve the product | EEA, UK, Switzerland: cookies off until consent (cookieless measurement only before then). Elsewhere: on by default, can be switched off | PostHog (with IP anonymisation; includes masked session replays and click heatmaps), Google Analytics 4 |
| Marketing / advertising | Attribute a visit to the partner or campaign that sent it, so partners can be paid and campaigns measured | Off until consent | Partner-programme attribution (diglot_aff, set by us); Meta (Facebook) Pixel |
Google Analytics 4 and Google Consent Mode. The Google tag loads for every visitor (not at all when your browser sends a Global Privacy Control signal), but its cookies follow the rules above. While analytics cookies are off — in the EEA, the UK and Switzerland until you accept, and anywhere after you reject or withdraw consent — it runs with Google Consent Mode set to “denied”: it sets and reads no cookies and sends Google only cookieless signals — for example that a page was viewed or a sign-up happened, plus your consent choice and ordinary request details such as browser type and IP address — which Google uses to measure and model conversions in aggregate. Where analytics cookies are on (after you accept, or by default outside those regions), the tag switches analytics storage to “granted” and uses the _ga cookies listed below.
Cookieless measurement before you choose (EEA, UK, Switzerland). Until you accept or reject, PostHog runs without cookies or any other storage on your device (no local storage, no session storage) and without a persistent identifier: it groups page views using a short-lived hash computed on its servers, which cannot be used to recognise you over time or across sites. Google Analytics sends only the cookieless signals described above. We do not link this data to an account and do not record sessions or heatmaps. If you accept, full analytics with cookies starts in the same page. If you reject, PostHog stops straight away and Google Analytics keeps sending only cookieless signals.
Advertising storage stays off without your acceptance, everywhere. Until you accept all cookies — including where analytics runs by default — Google Analytics runs with advertising storage turned off: no advertising cookies are set and no data is sent to Google Ads.
To decide which rule applies, your browser’s time-zone setting is used as a signal of your region. The check runs in your browser; we do not look up your location from your IP address for it. If the time zone points to the EEA, the UK or Switzerland, or cannot be read, we apply the opt-in rule and use only cookieless measurement until you choose.
The partner-programme cookie is first-party — set by our own domain, containing only an opaque identifier of the click that brought you here. The Meta Pixel is a third-party advertising tag: it loads only after you accept marketing cookies, and it lets us measure which advertising brought people to Diglot. Declining leaves it unloaded; nothing in the Service stops working.
3. Specific cookies you may see
| Name (prefix) | Provider | Category | Purpose | Lifetime |
|---|---|---|---|---|
sb-…-auth-token | Supabase | Strictly necessary | Keeps you signed in | Session / up to 7 days |
__cf_bm, cf_clearance | Cloudflare | Strictly necessary | Bot management, DDoS protection | 30 minutes – 1 year |
| Checkout session cookies | Our Merchant of Record (Dodo Payments; Paddle on failover) | Strictly necessary | Maintains the secure payment session while you pay | Session |
diglot_consent | Diglot | Strictly necessary | Stores your cookie-banner choices | 12 months |
diglot_locale, diglot_theme | Diglot | Functional | Remembers UI language and theme | 12 months |
diglot_aff | Diglot | Marketing | Records which partner’s link brought you here, so that partner can be paid if you subscribe. Contains an opaque click identifier — no name, e-mail, or browsing history | 60 days |
refgrow_ref_code | Refgrow | Marketing | Same purpose as diglot_aff, for the partner programme run on Refgrow. Set only after you accept marketing cookies, and only on a visit that did not arrive through a different partner link | 30 days |
ph_* | PostHog | Analytics | Product analytics, masked session replay and click heatmaps; events tied to a hashed device id, IPs anonymised. Replays hide all on-screen text and inputs. In the EEA, the UK and Switzerland set only after you accept analytics cookies; elsewhere set by default until you switch analytics off | Up to 12 months |
_ga, _ga_* | Google Analytics 4 | Analytics | Measures traffic, conversions and which pages people arrive on; with Google signals, aggregated reports for signed-in Google users who allow Ads Personalization. In the EEA, the UK and Switzerland set only after you accept analytics cookies; elsewhere set by default until you switch analytics off | Up to 24 months |
_fbp, _fbc | Meta (Facebook) | Marketing | Measures whether an advertisement led to a visit or a sign-up | Up to 3 months |
sentry_* (transient) | Sentry | Strictly necessary | Correlate front-end errors with a session for debugging | Session |
The list above is illustrative; the actual cookies set on a given visit depend on the page, your plan, and your consent choices. The current cookies are always disclosed via your browser’s developer tools.
4. Your choices
- Cookie banner — on your first visit you’ll see a banner with Accept all, Reject all, and Manage preferences at the same level of prominence. Rejecting all non-essential cookies is one click and does not break the Service. The banner stays until you make a choice. Choosing Reject switches analytics cookies off straight away, including in the page you have open: PostHog stops (including cookieless measurement), and Google Analytics returns to the cookieless signals described in section 2.
- In-product — change your choices any time at Settings → Privacy → Cookies.
- Browser-level — most browsers let you delete or block cookies. Blocking strictly necessary cookies will prevent you from signing in.
- Global Privacy Control (GPC) — if your browser sends a GPC signal, we treat it as an opt-out of all analytics (including cookieless measurement — the Google tag does not load at all) and advertising cookies, and of any “sale” or “sharing” of personal data under U.S. state privacy laws. GPC takes priority over the default and over an earlier acceptance.
- Do Not Sell or Share My Personal Information — for California and other U.S. states, use the link in the website footer. (As noted in our Privacy Policy, we do not sell or share your data, but we honour the request and the GPC signal regardless.)
5. Consent and the EU / UK ePrivacy framework
For visitors in the EEA, the United Kingdom and Switzerland, consent for non-essential cookies, including analytics cookies, is collected on an opt-in basis: before you choose, no analytics or advertising cookie is set and PostHog and Google Analytics store nothing on your device; only the cookieless measurement described in section 2 runs. No boxes are pre-ticked, the Reject all option is as easy to use as Accept all, and we re-ask for consent at most every 12 months or when a material new category is introduced. Outside those regions, analytics is on by default and can be switched off at any time; advertising and marketing cookies remain opt-in everywhere.
6. Third-party services
Some cookies are set by our service providers (“subprocessors”), not by Diglot directly. The full list is at /subprocessors and includes Cloudflare, Supabase, PostHog, Google Analytics, Meta, Sentry, our Merchant of Record, and — for the partner programme — Affonso and Refgrow. The partner-attribution cookie itself is set by us, not by Affonso. When you interact with content embedded from third parties (for example, a YouTube video on a blog post), those providers may set their own cookies under their own privacy policies.
7. Updates to this Cookie Policy
We may update this Cookie Policy when our cookie use, the underlying tools, or applicable law changes. The “Last updated” date at the top reflects the current version. Material changes — for example introducing a new category of cookies or a new provider — will be communicated via the cookie banner and a notice in the product.
8. Contact
Questions about this Cookie Policy or how to exercise your rights:
- Privacy / cookies: legal@diglot.ai
- General support: support@diglot.ai
Diglot OÜ — Republic of Estonia (registration in progress).
