Cookie Policy — Rezooh

This Cookie Policy explains how Rezooh, operated by Agile Invest Pty Ltd, uses cookies and similar technologies (such as localStorage, sessionStorage, and tracking pixels) on the Rezooh platform (the “Service”). Read this together with our Privacy Policy.

1. What cookies are

Cookies are small text files placed on your device when you visit a website. They are widely used to make websites work, remember your preferences, and provide usage information to operators. Similar technologies (browser storage, pixels) achieve comparable outcomes and are covered by this Policy.

2. How we use cookies

2.1 Strictly necessary

These are essential for the Service to function and cannot be disabled in product. Blocking them in your browser will prevent sign-in and most features from working.

Auth.js session cookies (next-auth.session-token, __Secure-next-auth.session-token) — maintains your authenticated session. Set by Rezooh. Duration: session, up to 30 days for “remember me”.
CSRF protection (next-auth.csrf-token) — prevents cross-site request forgery during sign-in. Set by Rezooh. Duration: session.
OAuth state and callback (next-auth.callback-url, next-auth.pkce.code_verifier) — maintains login state during Google sign-in. Set by Rezooh and Google. Duration: short-lived (until callback completes).
Stripe Checkout / Customer Portal (__stripe_mid, __stripe_sid) — set by Stripe on payment pages for fraud prevention and secure session handling. Duration: 1 year (mid) / 30 minutes (sid).

2.2 Functional / preference

UI preferences (theme, layout, dismissed banners) — stored in localStorage under rezooh-* keys. Set by Rezooh. Duration: until you clear it.

2.3 Analytics

We use PostHog to understand how users interact with the Service so we can improve it. PostHog uses cookies and/or local storage to attribute events to a session. We do not sell this data and use it only to improve the product.

PostHog (ph_* cookies and local storage). Set by PostHog, Inc. Purpose: page views, feature usage, session attribution. Duration: up to 1 year. See PostHog's privacy policy.
Sentry — sets a temporary cookie/local storage entry to correlate browser errors with backend traces. Used only for diagnostics, not advertising. See Sentry's privacy policy.

2.4 Campaign attribution links

Rezooh operates short redirect URLs under rezooh.com/r/<slug> that forward visitors to a Rezooh landing page with utm_* query parameters attached. These parameters are read by PostHog (above) to attribute visits to a referring channel (for example, a Reddit comment). The redirect itself does not set any cookies.

2.5 Marketing and advertising

We do not use advertising, retargeting, or cross-site tracking cookies on the Service today. If that changes, we will update this Policy and obtain consent where required.

3. Third-party cookies

Some cookies are set by third parties whose services are integrated into Rezooh. We do not control third-party cookies; refer to the relevant third-party privacy policy for details.

Google LLC — OAuth authentication when you sign in with Google. Google privacy policy.
Stripe, Inc. — payment processing on Checkout and Customer Portal pages. Stripe privacy policy.
PostHog, Inc. — product analytics. PostHog privacy policy.
Cloudflare Turnstile — bot-protection challenge on sign-in and contact forms. May set a short-lived cookie. Cloudflare privacy policy.

4. Consent

We do not load advertising, retargeting, or cross-site tracking cookies on rezooh.com or app.rezooh.comfor any visitor, regardless of region. Our product analytics (PostHog) sets only first-party cookies on this domain — analytics events are tunneled through rezooh.com itself rather than a separate analytics endpoint, so no cross-site tracking identifiers are placed on your device.

EU and UK users: the EU ePrivacy Directive and UK PECR apply to non-essential cookies. Because the Service does not place advertising, retargeting, or cross-site tracking cookies, we do not currently surface an EEA/UK consent banner. If we add cookies that require consent under those regimes in the future, we will update this Policy and obtain consent where required.

Australian users: Australian law does not currently mandate cookie consent banners. We provide this Policy and browser controls so you can make an informed choice.

5. Your choices

5.1 Browser settings

Most browsers let you refuse, delete, or be notified about cookies. See your browser's documentation:

Disabling strictly necessary cookies will prevent sign-in and most Service functionality.

5.2 PostHog opt-out

You can opt out of PostHog analytics by enabling “Do Not Track” in your browser, or by emailing privacy@rezooh.com with the email address on your account.

6. Do Not Track

PostHog honours the “Do Not Track” (DNT) browser signal. We do not use advertising cookies, and our analytics footprint is minimal by default.

7. Changes to this Policy

We will update this Policy when we add or remove cookies or change our use of tracking technologies. Material changes will be flagged via our standard policy update notice.

8. Contact

Questions about cookies can be sent to privacy@rezooh.com.

Agile Invest Pty Ltd · Sydney, Australia