Cookie Policy
Last updated: October 20, 2026
This Cookie Policy explains what cookies are, which cookies XBio uses, and how you can control them.
What Are Cookies?
Cookies are small text files placed on your device by a website. They are widely used to make websites work, improve user experience, and provide information to site owners.
Cookies We Set
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
| xbio.session_token | Authentication - keeps you logged in | 30 days | Necessary |
| theme | Stores light/dark mode preference | 1 year | Preference |
| xbio.last_login_method | Remembers which sign-in option you last used (email, Google, GitHub or Discord) so the sign-in page can highlight it. Holds only that word - no account or tracking data | 30 days | Preference |
| xbio_cookie_consent | Remembers whether you accepted or declined on the cookie banner, so it is not shown again on every page. Kept in your browser's local storage rather than as a cookie, and never sent to us | Until you change it or clear site data | Necessary |
| xbio_internal | Set only on browsers where an XBio staff account has signed in, so our own visits are left out of our analytics. Never set for anyone else, and holds no identifier | 1 year | Audience measurement |
| xbio_utm | Set only when you arrive on XBio through a link carrying campaign tags (utm_source, utm_medium, utm_campaign - for example a post of ours on TikTok). Holds just those tags, such as "tiktok / social / launch-week1": no identifier, so everyone arriving from the same link gets an identical cookie and it cannot recognise you. If you then create an account, the tags are recorded with your signup so we can tell which channels bring new users, and the cookie is deleted. Never set if you are already signed in | 30 days, or until you sign up | Audience measurement |
| xbio.unlock.<profile> | Set when you enter the right password on a password-protected profile, so that profile stays open while you browse it. Works for that one profile only | 12 hours | Necessary |
| xbio.subscribed.<profile> | Set when you subscribe to a profile whose links are for subscribers only, so its links stay unlocked on later visits. Holds no email address or identifier - every subscriber to that profile gets an equivalent cookie - and works for that one profile only | 1 year | Necessary |
Third-Party Cookies
Sentry Session Replay and performance tracing only run if you click "Accept" on the cookie banner - declining or not choosing keeps them off. Stripe and Cloudflare Turnstile are necessary for payments and signup spam protection to function, so they aren't gated by the banner.
Vercel Analytics and PostHog also run for everyone. They set no cookies and use no device storage; visits are counted with a hash of the incoming request that Vercel discards after 24 hours, so they can't recognise you on a later day or on another website, and no IP address is stored. PostHog works the same way, using a hash it computes on its own servers and rotates daily; on creators' profiles it records only that the page was viewed and how quickly it loaded.
Sentry error monitoring is a separate case. It stores nothing on your device - no cookies, no local or session storage - so there is nothing for a cookie banner to consent to. It runs for everyone on the basis of our legitimate interest in keeping the service working and secure, with IP address collection disabled and error reports scrubbed of email addresses and access tokens before they are sent. You can object to this at any time by contacting us.
| Service | Purpose | Type |
|---|---|---|
| Stripe | Fraud detection and secure payment processing. Set when you visit /shop or make a purchase. | Necessary |
| Cloudflare Turnstile | Bot/spam protection on the signup form. No tracking cookie - verifies your IP address is human. | Necessary |
| Sentry (error monitoring) | Crash and error reports so we can fix faults. Sets no cookies and uses no device storage. Runs for everyone under legitimate interest; IP collection is off and reports are scrubbed of emails and tokens. | Necessary |
| Sentry (session replay & tracing) | Replays a recording of your session when an error occurs, plus performance tracing. Uses session storage. Only loads if accepted. | Analytics |
| Vercel Analytics | Aggregate page view statistics. Sets no cookies and uses no device storage; visitors are counted with a request hash discarded after 24 hours, and no IP address is stored. Runs for everyone. | Cookieless analytics |
| PostHog | Product analytics, hosted in the EU: page views, page speed, clicks, heatmaps and scroll depth on XBio's own pages, and page views and page speed only on creators' profiles. Sets no cookies and uses no device storage; visitors are counted with a server-side hash that rotates daily, and no IP address is stored. Runs for everyone. | Cookieless analytics |
How to Control Cookies
You can change your cookie banner choice at any time, and withdrawing consent is as easy as giving it. Open (also in the site footer) to bring the banner back and pick again. If you decline after accepting, session replay stops straight away and tracing stops with the next page you load.
You can control or delete cookies at any time through your browser settings. Note that disabling the session cookie will log you out and prevent login. Browser-specific instructions:
Questions
For questions about our use of cookies, see our Privacy Policy or contact us.