Cookie Policy
This policy lists the cookies set by legitym.com, what they are for and how to refuse them.
Last updated: October 23, 2026
What Are Cookies?
A cookie, or a tracker kept in your browser storage (localStorage), is a small piece of data stored on your device by the site you visit. Legitym uses very few: no advertising cookies, no social buttons that follow you, no data sold.
What we use cookies for
Legitym sets cookies to:
- Keep you signed in to your account
- Protect sign-in forms against request forgery
- Remember the language you chose
- Measure audience anonymously (page views, journeys), with no advertising or cross-site tracking
- Remember your choices (audience measurement refusal, consent or refusal of attribution trackers)
- Only with your consent: know which post or referrer brought you to the site
Types of Cookies We Use
Strictly necessary cookies
Required for the site to work (sign-in, security, language). They are exempt from consent.
Audience measurement
Anonymous statistics via PostHog (EU-hosted, anonymised IP addresses, first-party cookie limited to 13 months, no cross-site matching). Meets the CNIL exemption conditions; you can refuse it at any time with the button at the top of the page.
Visit attribution (with your consent)
Two services tell us where a visit comes from: Pulpi, which publishes our posts on social networks (a random identifier and the landing page are sent to pulpi.ai), and the iCraft referral programme (the referral code in the link is kept for 30 days and reported to refer.icraft.dev). They load only after "Accept all"; you can withdraw your consent at any time with the button at the top of the page.
Cookies We Use
| Cookie Name | Purpose | Duration | Type |
|---|---|---|---|
| __session | Signing in to your account | 14 days | Necessary |
| authjs.csrf-token | Sign-in form protection | Session | Necessary |
| NEXT_LOCALE | Chosen language | 1 year | Necessary |
| ph_*_posthog | Anonymous audience measurement (PostHog) | 13 months | Audience measurement |
| legitym_audience_optout | Remembers that you refused audience measurement | 13 months | Necessary |
| legitym_cookie_consent | Remembers your consent or refusal of attribution trackers (localStorage) | 6 months | Necessary |
| __hydra_session | Random Pulpi identifier: source post of the visit (localStorage, after consent) | 6 months at most, erased when consent is withdrawn | Attribution (consent) |
| icraft_ref | iCraft referral code found in the landing link (localStorage, after consent) | 30 days | Attribution (consent) |
Managing cookies
Two ways, which can be combined:
From your browser
Every browser lets you block or delete cookies ("Privacy" or "Security" settings). Blocking necessary cookies will prevent you from signing in.
From this page
The buttons at the top of the page separately control audience measurement (choice kept for 13 months) and attribution trackers (choice kept for 6 months, then asked again).
Changes to This Policy
We will update this page if we add or remove a cookie. The date at the top shows the last change.
Contact us
For any question about cookies or your personal data:
Email: privacy@legitym.com