# Cookie Policy Version: 1.0.4 - Effective: 21 October 2026 This policy explains the cookies and similar technologies (browser storage, pixels, and scripts) that SetLuca, LLC uses on **setluca.com** and in the Luca app at **app.setluca.com**, and how you control them. For everything else about personal data, see our [Privacy Policy](/privacy). ## The short version - We use a small number of cookies that the site and app need to work. These are always on. - **On setluca.com, analytics (PostHog) and ad measurement (the Meta Pixel) are on by default.** They start when a page loads and stop as soon as you click **Turn off**, in the banner or in **Privacy choices**. One switch covers both. - **Turning them off is as easy as accepting**, on the first screen. Once you turn them off, neither tool loads again on our site, and we clear what they stored in your browser. - We treat a **Global Privacy Control (GPC)** signal from your browser as a choice to turn them off. - We remember your choice for **180 days**, then ask again. You can change it any time from the **Privacy choices** button at the bottom of every page on setluca.com, or **App privacy choices** in Luca. - Inside the Luca app, advertising stays off until you allow it. ## What cookies are Cookies are small files a website stores in your browser. Similar technologies include local storage, session storage, and pixels (tiny images or scripts that report a visit). We call them all "cookies" here. ## The cookies we use ### Strictly necessary (always on) These are needed to provide a service you asked for, such as signing in or remembering your privacy choice, so the law doesn't require consent for them. You can block them in your browser, but sign-in and other features will stop working. | Name | Set by | Purpose | Duration | | --- | --- | --- | --- | | `luca_privacy` | setluca.com, app.setluca.com | Remembers your privacy choice | 180 days | | `luca.session_token` (prefixed `__Secure-` over HTTPS) and `luca.session_data` | setluca.com and app.setluca.com (shared across setluca.com) | Keeps you signed in and protects your session; session_data caches your session for a few minutes | session_token 7 days, refreshed when you use the app; session_data 5 minutes | | `luca.state` | app.setluca.com | Security during sign-in with Google or Facebook | A few minutes | | `luca-active-workspace` | app.setluca.com | Remembers which workspace you have open | 1 year | | `luca_reset_token` | app.setluca.com | Lets you finish a password reset | 1 hour | | `luca_think_` | api.setluca.com | Authorizes the connection for an Ask Luca chat | 60 seconds | ### Analytics These help us understand how people find and use our website and app, so we can improve them. On setluca.com they're on by default and stop when you click **Turn off**. In the Luca app they follow your choice in **App privacy choices**. | Name | Set by | Purpose | Duration | | --- | --- | --- | --- | | `ph__posthog` (cookie and local storage) | PostHog, served from our own subdomain `e.setluca.com` | Counts visits and pages viewed and links them to one pseudonymous browser ID. If you later sign up, your earlier visits to our website are linked to your account | 1 year | | `ph__window_id` and `ph__primary_window_exists` (session storage) | PostHog | Tracks the browser tab for analytics | Until the tab closes | | `luca_attribution` (session storage) | SetLuca, on setluca.com | Remembers how you arrived (landing page, referring site, campaign tags, and ad click IDs) so we can tell which campaigns bring sign-ups | Until you close the tab | | `sentryReplaySession` (session storage) | Sentry | Replays a sample of app sessions (10%), and sessions where an error happened, only if you've allowed analytics in the app. All text and inputs are masked and media is blocked | Until you close the tab, or 15 minutes of inactivity; replays kept up to 90 days | While analytics is on, PostHog and Sentry receive your IP address and browser details. We don't use session recording, heatmaps, or click tracking on setluca.com, and we don't send message content, lead names, or emails to analytics tools. ### Ad measurement on setluca.com (on until you turn it off) These measure whether our ads on Meta (Facebook and Instagram) lead to visits and sign-ups. On setluca.com they share the analytics switch: they're on by default and stop when you click **Turn off**. | Name | Set by | Purpose | Duration | | --- | --- | --- | --- | | Meta Pixel script, `_fbp` | Meta, on setluca.com | Identifies your browser to Meta to measure our ads | 90 days | | `_fbc` | Meta, on setluca.com | Stores the ad click ID when you arrive from a Meta ad | 90 days | If you give us your email in a form on setluca.com while ad measurement is on, we also send Meta a hashed copy of that email, your IP address and browser details, and Meta's click and browser IDs, so Meta can tell us whether you came from one of our ads. If you've turned it off, we send Meta nothing from the website. Account advertising (sending sign-up and subscription events to Meta from our servers once you have a Luca account) is a separate choice in **App privacy choices**. It's off until you allow it, and the website switch doesn't turn it on. See "Advertising choices" in our [Privacy Policy](/privacy). ### Why these are on by default We run analytics and ad measurement on setluca.com because we have a legitimate interest in knowing how people find our website, which pages work, and whether our ads are worth paying for. We keep them to that: no session recording, no heatmaps, and no message content. Because they run before you choose, we make turning them off a single click, we remember that choice for 180 days, and we honor GPC. You can also object at any time by emailing [support@setluca.com](mailto:support@setluca.com). ### Third-party content The Luca sign-up page doesn't load images or content from other sites before you choose. When you choose to sign in with Google or Facebook, or connect Instagram, Messenger, or a calendar, you go to that company's site, and its own cookie policy applies there. ## Your choices - **First visit to setluca.com.** Analytics and ad measurement start when the page loads. The banner lets you click **Accept** to keep them on or **Turn off** to stop them, and both buttons look the same. **Settings** shows the same choice as one switch. Turning them off stops PostHog and the Meta Pixel, clears what they stored in your browser, and keeps them off on later visits. - **Change your mind.** Use the **Privacy choices** button at the bottom of every page on setluca.com, or **App privacy choices** in Luca's settings. You can also opt out by emailing [support@setluca.com](mailto:support@setluca.com). Opting out or withdrawing consent stops the tools from that point on; it doesn't delete data already collected, but you can ask us to delete it at [support@setluca.com](mailto:support@setluca.com). - **GPC.** If your browser sends Global Privacy Control, analytics and ad measurement don't load on setluca.com. On a signed-in app request, GPC also withdraws account advertising consent. - **Expiry.** Your choice lasts 180 days. After that, or if we change the categories in this policy, we ask again. - **Browser settings.** You can delete or block cookies in your browser. Blocking strictly necessary cookies will stop sign-in from working. ## Changes We'll update this page, and its date, whenever we add, remove, or change a cookie. If we add a new optional category, we'll say so here and ask for your choice again. ## Contact Privacy and deletion requests, and general questions: [support@setluca.com](mailto:support@setluca.com) - SetLuca, LLC, 2810 North Church Street, Wilmington, DE 19802, United States Users in Spain: this policy is provided under Article 22.2 of Spain's Law 34/2002 on information society services (LSSI). The supervisory authority is the AEPD (www.aepd.es).