Cookie Policy

Last updated: October 7, 2026

What this policy covers

Cookies are small text files a website stores in your browser. Websites can also keep similar information in your browser's storage. This page lists every cookie and storage item Rentlab uses, what each one is for, how long it lasts, and how to turn off the ones the service does not need.

The short version

Analytics are on unless you reject them. We use PostHog and Google Analytics to see how people find Rentlab and where the app is confusing. Click Reject in the cookie banner, or in the "Your choice" section below, to turn them off.
Advertising is off unless you accept it. The Meta Pixel sends nothing to Meta until you click Accept.
We honor Global Privacy Control. If your browser sends this signal, we treat it as if you clicked Reject, and the banner does not ask you.
A few items are always on because the service needs them, such as the cookie that keeps you signed in.

Necessary: always on

These keep you signed in and remember settings you chose. They are always on and are not used for analytics or advertising.

Name	What it does	How long	Set by
`sb-…-auth-token`	Keeps you signed in. A large session is split across several cookies ending in `.0`, `.1` and so on.	Up to 400 days, removed when you sign out	Rentlab, through Supabase
`sidebar_state`	Remembers whether the app's sidebar is open or closed	7 days	Rentlab
`fb-pixel-consent` (browser storage)	Remembers whether you clicked Accept or Reject, and whether your browser was sending Global Privacy Control when you accepted	Until you clear this site's data	Rentlab
`theme` (browser storage)	Remembers light or dark mode in the app	Until you clear this site's data	Rentlab

The app also keeps a few small flags in browser storage, such as whether you dismissed the prompt to install the app. They stay in your browser.

Analytics: on unless you reject them

These run from your first visit, unless your browser sends Global Privacy Control. Rejecting turns them off in this browser.

Name	What it does	How long	Set by
`ph_phc_…_posthog` (browser storage)	PostHog product analytics: a random ID for your browser, the pages you view and what you click. PostHog also records sessions so we can see where people get stuck. A recording shows what was on the screen, including text in the app; what you type into fields is hidden before it leaves your browser. Once you sign in, this activity is linked to your account.	Until you clear this site's data	PostHog (United States), sent through rentlab.app
`_ga`, `_ga_*`	Google Analytics: counts visits and key actions such as signing up, adding a property and upgrading	2 years	Google
`ph_first_touch`	Remembers how you first found Rentlab: the campaign tags in the link, the site that sent you, and the first page you saw. If you sign up, this is attached to your account so we know which channel worked.	90 days	Rentlab

Advertising: off unless you accept it

Until you click Accept, the Meta Pixel sends nothing to Meta and sets no cookie. If you reject, or your browser sends Global Privacy Control, its script does not load at all.

Name	What it does	How long	Set by
`_fbp`, `_fbc`	Meta Pixel: tells Meta which pages you visit here and whether you sign up, so Meta can measure our ads and decide who to show them to	90 days	Meta

Not controlled by the banner

Vercel Web Analytics and Speed Insights count page views and measure how fast pages load. They use no cookies or browser storage.
Events recorded by our servers. When you are signed in, our servers send PostHog a few events tied to your account: adding a property or an expense, starting a subscription, and using the help chat. Your banner choice is stored in your browser, so it does not reach these. Global Privacy Control does not cover them either: PostHog processes them for us, and they are not sold or shared for advertising.
Other companies' pages. When you use Sign in with Google, or pay on Stripe's checkout page, those companies set their own cookies under their own policies.

Global Privacy Control

Global Privacy Control is a browser setting that tells websites not to sell or share your personal information. It is on by default in some browsers, such as Brave and DuckDuckGo, and you can turn it on in others, such as Firefox.

If your browser sends it, we treat it as if you clicked Reject: PostHog and Google Analytics do not run, the Meta Pixel does not load, the cookies a Reject deletes are deleted, and the banner does not ask you. If you clicked Accept in this browser before it sent the signal, the signal comes first; your earlier choice applies again if you turn the signal off. If you want analytics and the Meta Pixel on anyway, click Accept below. An Accept made while your browser sends the signal stays in effect until you click Reject.

Your choice

Your choice applies to this browser only. Rejecting stops PostHog and Google Analytics, keeps the Meta Pixel off, and deletes the Google Analytics, Meta and ph_first_touch cookies. Accepting turns analytics and the Meta Pixel on. You can change your mind here at any time.