Cookies

In short

We set three cookies, all strictly necessary, all first-party, all HttpOnly (page scripts can't read them) and Secure: one to keep creators signed in, one that exists only during X sign-in, and one that shows you fresh data right after you pay or save a change. We set no advertising or tracking cookies and embed no third-party widgets. Advertisers don't sign in, so they get no login cookie; their private results link (one for all their campaigns, valid 24 hours) is emailed and nothing about it is stored in the browser.

Cookies we set

• post_session

  Creators who sign in with X · 7 days, or until you log out

  Keeps you signed in. Holds a random token; the server keeps only a hash of it.

• oauth_state

  Creators, during X sign-in · 10 minutes at most

  Protects the sign-in against forgery: an encrypted, tamper-proof value (a one-time check code and the page to return to). Deleted as soon as sign-in finishes.

• xmp_live

  Anyone who just paid or made a change · 30 minutes at most

  A signed marker that lets your browser see fresh data (your new campaign or change) instead of a cached copy, until your payment is confirmed.

Browser storage we use

• theme (local storage): Your light / dark theme choice.
• PostHog analytics (local storage, ph_*): An anonymous visitor id for counting page views. No cookie, no session recording, nothing you type, and page addresses are sent without their query string.
• xr_metrics_try (local storage): Creator dashboard: when your X stats were last refreshed, so it isn't retried too often.
• Sidebar checkout flag (session storage): Remembers, across the payment page, that you bought a sidebar spot so we show the right message. Cleared on return.

Other sites

Payment happens on Dodo Payments' checkout page, and creator sign-in on x.com. Those sites set their own cookies under their own policies; we don't see or control them.

Managing them

Logging out deletes the sign-in cookie. You can also clear this site's data in your browser settings at any time; the only effect is that creators have to sign in again and the theme resets. Blocking cookies entirely stops creator sign-in from working, but browsing and paying still work.