COOKIE POLICY
Last updated: September 11, 2026
Strictly necessary: one session cookie (always on). Optional: PostHog analytics cookies (consent required). No advertising cookies of our own. No behavioral profiling.
FindMeComics sets a strictly necessary session cookie to keep you signed in, and — with your consent — analytics cookies via PostHog to understand how the site is used. Before you make a choice, PostHog runs in a cookieless, memory-only mode that counts page views without storing anything on your device (details below); choosing “Essential Only” stops even that. We set no advertising cookies or tracking pixels of our own and do no behavioral profiling. The podcast players on episode picks can set advertising cookies, so we ask before loading them (details below). You can change your choice at any time via the Cookie Preferences link in the footer.
WHAT IS A COOKIE?
A cookie is a small text file that a website stores in your browser. Your browser sends it back to the server on every subsequent request so the server can recognize you. Cookies cannot execute code and do not by themselves identify you by name — they store an identifier that the server maps to your account.
THE COOKIES WE SET
We set up to four cookies. Three come from NextAuth.js (our open-source authentication library), and one holds an invite while you register. All four are strictly necessary — they are technically required for authentication to work and are exempt from consent requirements under the ePrivacy Directive Art. 5(3) and UK PECR Reg. 6(4).
| Cookie name | Purpose | Contents | Expires | Flags |
|---|---|---|---|---|
| __Secure-next-auth .session-token(dev: next-auth.session-token) | Session token. Keeps you signed in across page loads and browser restarts until you sign out or your session expires. | An encrypted JWT containing your session ID, username, and role flags (e.g. ageVerified, isAdmin). No email or password is stored in the cookie. | 30 days (or sign-out) | HttpOnly Secure SameSite=Lax |
| __Host-next-auth .csrf-token(dev: next-auth.csrf-token) | CSRF protection. Prevents cross-site request forgery attacks on sign-in and sign-out forms. Required for security. | A random token paired with a hash. Contains no personal data. | Browser session | SameSite=Lax (not HttpOnly — must be readable by the sign-in form) |
| __Secure-next-auth .callback-url(dev: next-auth.callback-url) | OAuth redirect. Temporarily stores the page you were trying to reach so you are redirected there after signing in via Google. Set only during an active sign-in flow and cleared immediately after. | The URL you were visiting before sign-in. No personal data. | Browser session (cleared post-login) | Secure SameSite=Lax |
| fmc_invite | Registration invite. Set when you open the invite link in your approval email, so the sign-up form is still there if you reload the page. Cleared once your account is created. | The email address the invite was sent to, and the signed code from the invite link that proves it is yours. | 7 days (or sign-up) | HttpOnly Secure SameSite=Lax |
PAGE-VIEW COUNTING BEFORE YOU CHOOSE (NO COOKIES)
Until you make a choice on the consent banner, PostHog runs in a memory-only mode: it counts page views and referrers but sets no cookie, writes nothing to localStorage, transmits no IP address, and forgets each tab when it closes — comparable to ordinary server-log counting. Clicking Essential Only stops even this: nothing analytics-related loads on any future visit, and any in-progress counting stops immediately.
ANALYTICS COOKIES (CONSENT REQUIRED)
If you click Accept Analytics on the banner shown at your first visit, PostHog upgrades to persistent mode: it sets a cookie and uses localStorage to associate your page views and explicit interactions with a pseudonymous device ID.
We collect only named, explicit events— page views, listing created, checkout completed, wantlist item added, and similar product actions. PostHog's autocapture (which would automatically record every click and form-field value) is disabled. No form input content is ever captured. IP addresses are excluded from all event properties.
No email address, name, or IP address is transmitted to PostHog. If you are signed in, your pseudonymous FMC account ID (an internal identifier — not your email or username) is also passed to PostHog so that events across sessions can be linked to a single account rather than treated as separate anonymous visitors. If you are not signed in, only the device ID is used.
| Name / storage | Purpose | Expires |
|---|---|---|
| ph_key_posthog (localStorage) | Stores the anonymous device ID and pending event queue used by PostHog to associate page views and interactions across sessions. | Persistent (localStorage) |
| ph_key_posthog (cookie) | Fallback cookie mirror of the localStorage entry for browsers that block localStorage in third-party contexts. | 1 year |
| fmc-analytics-consent (localStorage) | Your cookie-banner choice (“accepted” or “declined”) so the banner doesn't re-prompt on every visit. Set on either choice. | Until you clear it or change your choice |
| fmc-anon-id (localStorage) | A random ID attached to the consent record we keep server-side as evidence of your choice (it links your banner choice to a device, not your browsing). Set on either choice. | Persistent (localStorage) |
Data is sent to PostHog's US servers (us.i.posthog.com). PostHog acts as a data processor under a Data Processing Agreement ↗ that includes EU Standard Contractual Clauses. You can withdraw consent at any time via the Cookie Preferenceslink in the footer — choose “Essential Only” and capture stops immediately, stored identifiers are dropped, and analytics will not load on future visits.
WHAT WE DO NOT SET
- Advertising or tracking cookies — we do not run retargeting, interest-based advertising, or behavioral profiling.
- Social / third-party cookies — we add no social media pixels. Some outside services set their own cookies or browser storage when you use them:
- Google, during Google sign-in.
- Stripe, on its hosted checkout and seller-onboarding pages.
- Cloudflare, during the bot check on the waitlist, newsletter, registration and password-reset forms.
- The Megaphone and YouTube players on podcast episode picks, only after you press Listen or Watch and agree to load them. See Podcast players below.
- A/B test or personalization cookies — we do not run cookie-based experiments.
GOOGLE SIGN-IN (OAUTH)
Google sign-in is not offered right now. Accounts use an email address and a password, and nothing below happens. This section stays so the record is here if that changes.
If you choose to sign in with Google, your browser will interact with Google's servers during the OAuth handshake. Google may set its own cookies on accounts.google.com as part of that process. Those cookies are governed entirely by Google's Privacy Policy ↗ — FindMeComics does not control, read, or benefit from them. After the handshake completes, only our session-token cookie (above) is active.
Google Sign-In is entirely optional. You can register and sign in with an email address and password instead, in which case no interaction with Google's servers occurs at all.
CLOUDFLARE TURNSTILE (BOT CHECK)
The waitlist, newsletter, registration and password-reset forms run Cloudflare Turnstile, a check that tells people from bots. It runs in a frame served from challenges.cloudflare.com, and Cloudflare may set its own strictly necessary cookies on that domain while it runs. FindMeComics sets no cookie for the check and can't read Cloudflare's. Cloudflare says it uses the signals only to detect bots and to improve Turnstile, not to identify, profile or target anyone. Details are in the Turnstile Privacy Addendum ↗.
PODCAST PLAYERS (WE ASK FIRST)
Podcast episode picks have Listen and Watch buttons. Nothing loads from Megaphone or YouTube until you press one, and the first press asks before loading the player.
- Megaphone(audio) loads Google Analytics, Google's advertising tags and an eXelate pixel. The eXelate pixel sets two cookies on
exelator.comthat last 120 days. - YouTube (video, from
youtube-nocookie.com) stores data in your browser and can set cookies once the video plays.
Each notice also links to the episode's MP3 file on Megaphone, or to the video on YouTube. If you load a player, we store fmc-embed-consent in localStorageso we don't ask again on this device. It holds only the player names. Choosing Essential Onlyunder Cookie Preferences clears it and closes any player already open. Megaphone's and YouTube's cookies fall under their own policies, and FindMeComics can't read them.
THE CONSENT BANNER
On your first visit we show a banner with two options: Accept Analytics (loads PostHog) and Essential Only (session cookie only, PostHog never loads). Essential Only also clears any yes you gave the podcast players. Your choice is stored in localStorage and respected on every subsequent visit. The session cookie is set regardless of your choice — it is strictly necessary for authentication and falls under the ePrivacy Directive Art. 5(3) / PECR Reg. 6(4) exemption.
MANAGING OR DELETING COOKIES
You can delete or block cookies at any time through your browser settings. If you delete the session cookie you will be signed out. If you block all cookies, sign-in will not work — the session cookie is technically required.
Browser cookie settings guides: Chrome ↗ · Firefox ↗ · Safari ↗ · Edge ↗
CHANGES TO THIS POLICY
If we add new non-strictly-necessary cookies we will update this page, update the “Last updated” date, and implement a proper consent mechanism before setting them.
QUESTIONS
Email privacy@findmecomics.com. See also our full Privacy Policy and Privacy Policy § 12 (Cookies).