Cookie Policy
Last updated September 26, 2026
This page lists the cookies and browser storage Circl uses, what each one is for, how long it lasts and how to control it — and, separately, the other companies your browser contacts while you use the site. Every cookie we set is first-party, and none of it is advertising.
01How Circl uses cookies
Cookies are small files a website stores in your browser. Alongside them we use related browser storage — localStorage and sessionStorage — which works the same way for our purposes. Every cookie and storage entry Circl sets is first-party: set by circlhq.com itself, never by an outside advertising network.
We don't use advertising cookies, and we don't sell or share your data with ad networks. What we set falls into two buckets: essential cookies that make the site work, and optional analytics that run only if you turn them on.
First-party cookies aren't the whole picture, though. A few pages load something from another company's server — an anti-bot check, an address lookup, an image — and a couple of flows hand you over to another company's site entirely. Those requests don't create Circl cookies, but the company receiving them does see them, so each one is listed in “Other companies your browser contacts” below.
02Essential cookies
These are always on because Circl can't function without them — they keep you signed in and remember your privacy choice. They don't track you across other sites.
| Cookie | Purpose | Retention |
|---|---|---|
| sb-<project-ref>-auth-token (and .0 / .1 chunks) | Supabase authentication — keeps you signed in as you move between pages. | Persists while you're signed in; refreshed automatically. |
| __Host-circl_consent (circl_consent on http) | Stores your cookie choices so we don't ask again on every visit. | 6 months. |
03Analytics cookies
Analytics run only after you enable them — from the banner shown on your first visit, the preferences dialog, or the button below. They help us understand which features people use so we can improve Circl. If you later withdraw consent, we switch analytics off and remove these entries.
| Cookie / storage | Purpose | Retention |
|---|---|---|
| ph_<project-key>_posthog (cookie) and ph_* localStorage | PostHog product analytics, served through our first-party /ingest proxy. Set only after you enable analytics. | About 12 months; removed when you withdraw consent. |
04Other companies your browser contacts
A cookie is one thing; a request is another. On some pages your browser fetches a script, a frame, an image or a search result from another company's server. Those requests set no Circl cookie, but the company receiving them sees the request and your IP address — and where something runs in its own frame or on its own domain, it can set cookies there that Circl neither sets nor reads. None of this is advertising, and none of it builds a profile of you.
| Third party | When your browser contacts it, and what it gets | Cookies |
|---|---|---|
| SupabaseOur database, sign-in and file storage | On every signed-in page, and on public Circl pages that show uploaded images.It receives your sign-in request, the data you're reading or saving, and the files you upload or view. | None of its own. Your session lives in the first-party cookie listed above. |
| CloudflareTurnstile anti-bot check | On the sign-in and sign-up screens, when the check is switched on.It receives a challenge token and the signals Turnstile uses to tell a person from a bot — no account data. | May set its own on challenges.cloudflare.com, inside Cloudflare's own frame. Nothing on circlhq.com. |
| OpenStreetMap FoundationNominatim address lookup | In the location field of the hosting dashboard — a Circl's location, an event's address, a membership's location.It receives the address text you type, sent as you type it, and your IP address. Not your name, your account, or anything else about you. | None. |
| CARTOMap tiles | Only while a map is on screen — an event's location map in the hosting dashboard's “Preview as member”, and the maps in Circl's staff moderation console.It receives your IP address, the site the map is on (circlhq.com, not the page) and which map tiles to draw, so roughly the area being viewed. Not your name, your account, or anything else about you. | None. |
| StripePayouts and payments | When a host connects payouts, you leave circlhq.com for Stripe's own pages — see “Payments and Stripe” below.Stripe receives whatever you enter once you're there. | Its own, on stripe.com, under Stripe's cookie policy. |
| Google · AppleOptional sign-in | Only if you choose “Continue with Google” or “Continue with Apple”.You're taken to their own sign-in page, so they see that you're signing in to Circl. | Their own, on their own domains. |
Two things worth saying plainly. Analytics do not go straight to PostHog: they're routed through circlhq.com, so your browser never contacts PostHog directly. And there are no advertising, retargeting or social-media tracking scripts anywhere on this site.
05Payments and Stripe
Circl sets no Stripe cookies on our own domain — the website doesn't load Stripe's scripts.
If you're a host connecting payouts, we send you to Stripe-hosted pages on stripe.com to finish onboarding. There, Stripe sets its own cookies (for example __stripe_mid, which lasts about a year, and __stripe_sid, which lasts about 30 minutes) under Stripe's own cookie policy — not ours.
06Managing your choices
You can change your mind at any time. Use the “Cookie preferences” link in the site footer, or the button below, to reopen your choices and turn analytics on or off.
You can also clear or block cookies in your browser settings. Note that blocking the essential cookies will sign you out and stop Circl from working properly — the site relies on them to keep your session active.
Reopen your preferences to turn analytics on or off. Essential cookies stay on so you remain signed in.