1. On statsy.co and the Statsy app
Our marketing pages set no cookies at all. When you sign in, we set only what is needed to keep you signed in and remember your choices:
| Name | Purpose | Lasts | Type |
|---|---|---|---|
better-auth.session_token | Keeps you signed in. HttpOnly and Secure. | 7 days, renewed while you use Statsy | Strictly necessary |
statsy_org | Remembers which workspace you last opened. | 1 year | Functional |
statsy.sidebar.collapsed | Remembers whether you collapsed the sidebar (browser storage, not a cookie). | Until cleared | Functional |
theme | Remembers light or dark mode (browser storage, not a cookie). | Until cleared | Functional |
In production the session cookies carry the __Secure- prefix. None of these are used for advertising or shared with anyone.
2. On websites that use the Statsy script
What the script stores in a visitor’s browser depends on the tracking mode the site owner picks:
| Name | Mode | Purpose | Lasts |
|---|---|---|---|
statsy_vid | Full (and Auto outside the EU/UK) | A random first-party identifier so return visits and purchases connect to the same visitor. | 1 year |
statsy_sid | Full (session storage) | Groups page views from one browser tab into a session. | Until the tab closes |
statsy_last | Full (session storage) | Time of the last event, to end a session after 30 minutes of inactivity. | Until the tab closes |
statsy_mode | All modes (session storage) | Caches which tracking mode applies, so the script does not ask on every page. | Until the tab closes |
statsy_consent | When the site asks for consent (local storage) | Remembers the visitor’s consent choice passed to Statsy by the site. | Until cleared |
statsy_optout | When a visitor opts out (local storage) | Stops the script from sending anything from this browser. | Until cleared |
In cookieless mode nothing that identifies the visitor is stored in the browser; sessions are grouped on our servers instead. The script sets no third-party cookies and does not track visitors across different websites. By default it sends nothing when the browser sends Do Not Track or Global Privacy Control, unless the site owner has switched that off.
3. For site owners
You decide which mode your site uses and you are responsible for telling your visitors and, where the law requires it, asking for consent. Cookieless mode avoids cookies and persistent identifiers, which in many cases removes the need for a consent banner for analytics, but rules differ by country and by how you configure Statsy. If in doubt, ask your adviser. See the privacy policy for what the script collects.
4. How to control them
You can clear or block cookies and browser storage in your browser settings. Blocking the session cookie on statsy.co will sign you out. On a site using Statsy, turning on Do Not Track or Global Privacy Control reduces or stops what the script stores. Questions: support@statsy.co.