COOKIE POLICY
Last updated: May 1, 2026
Strictly necessary: one session cookie (always on). Optional: PostHog analytics cookies (consent required). No advertising. No behavioral profiling.
FindMeComics sets a strictly necessary session cookie to keep you signed in, and — with your consent — analytics cookies via PostHog to understand how the site is used. Before you make a choice, PostHog runs in a cookieless, memory-only mode that counts page views without storing anything on your device (details below); choosing “Essential Only” stops even that. We do not use advertising cookies, tracking pixels, or behavioral profiling of any kind. You can change your choice at any time via the Cookie Preferences link in the footer.
WHAT IS A COOKIE?
A cookie is a small text file that a website stores in your browser. Your browser sends it back to the server on every subsequent request so the server can recognize you. Cookies cannot execute code and do not by themselves identify you by name — they store an identifier that the server maps to your account.
THE COOKIES WE SET
We set up to three cookies, all from NextAuth.js (our open-source authentication library). All three are strictly necessary — they are technically required for authentication to work and are exempt from consent requirements under the ePrivacy Directive Art. 5(3) and UK PECR Reg. 6(4).
| Cookie name | Purpose | Contents | Expires | Flags |
|---|---|---|---|---|
| __Secure-next-auth .session-token(dev: next-auth.session-token) | Session token. Keeps you signed in across page loads and browser restarts until you sign out or your session expires. | An encrypted JWT containing your session ID, username, and role flags (e.g. ageVerified, isAdmin). No email or password is stored in the cookie. | 30 days (or sign-out) | HttpOnly Secure SameSite=Lax |
| __Host-next-auth .csrf-token(dev: next-auth.csrf-token) | CSRF protection. Prevents cross-site request forgery attacks on sign-in and sign-out forms. Required for security. | A random token paired with a hash. Contains no personal data. | Browser session | SameSite=Lax (not HttpOnly — must be readable by the sign-in form) |
| __Secure-next-auth .callback-url(dev: next-auth.callback-url) | OAuth redirect. Temporarily stores the page you were trying to reach so you are redirected there after signing in via Google. Set only during an active sign-in flow and cleared immediately after. | The URL you were visiting before sign-in. No personal data. | Browser session (cleared post-login) | Secure SameSite=Lax |
PAGE-VIEW COUNTING BEFORE YOU CHOOSE (NO COOKIES)
Until you make a choice on the consent banner, PostHog runs in a memory-only mode: it counts page views and referrers but sets no cookie, writes nothing to localStorage, transmits no IP address, and forgets each tab when it closes — comparable to ordinary server-log counting. Clicking Essential Only stops even this: nothing analytics-related loads on any future visit, and any in-progress counting stops immediately.
ANALYTICS COOKIES (CONSENT REQUIRED)
If you click Accept Analytics on the banner shown at your first visit, PostHog upgrades to persistent mode: it sets a cookie and uses localStorage to associate your page views and explicit interactions with a pseudonymous device ID.
We collect only named, explicit events— page views, listing created, checkout completed, wantlist item added, and similar product actions. PostHog's autocapture (which would automatically record every click and form-field value) is disabled. No form input content is ever captured. IP addresses are excluded from all event properties.
No email address, name, or IP address is transmitted to PostHog. If you are signed in, your pseudonymous FMC account ID (an internal identifier — not your email or username) is also passed to PostHog so that events across sessions can be linked to a single account rather than treated as separate anonymous visitors. If you are not signed in, only the device ID is used.
| Name / storage | Purpose | Expires |
|---|---|---|
| ph_key_posthog (localStorage) | Stores the anonymous device ID and pending event queue used by PostHog to associate page views and interactions across sessions. | Persistent (localStorage) |
| ph_key_posthog (cookie) | Fallback cookie mirror of the localStorage entry for browsers that block localStorage in third-party contexts. | 1 year |
| fmc-analytics-consent (localStorage) | Your cookie-banner choice (“accepted” or “declined”) so the banner doesn't re-prompt on every visit. Set on either choice. | Until you clear it or change your choice |
| fmc-anon-id (localStorage) | A random ID attached to the consent record we keep server-side as evidence of your choice (it links your banner choice to a device, not your browsing). Set on either choice. | Persistent (localStorage) |
Data is sent to PostHog's US servers (us.i.posthog.com). PostHog acts as a data processor under a Data Processing Agreement ↗ that includes EU Standard Contractual Clauses. You can withdraw consent at any time via the Cookie Preferenceslink in the footer — choose “Essential Only” and capture stops immediately, stored identifiers are dropped, and analytics will not load on future visits.
WHAT WE DO NOT SET
- Advertising or tracking cookies — we do not run retargeting, interest-based advertising, or behavioral profiling.
- Social / third-party cookies — no social media pixels, no embedded widgets that set their own cookies. The only external service that may set a cookie during sign-in is Google, via our OAuth integration — see below.
- A/B test or personalization cookies — we do not run cookie-based experiments.
GOOGLE SIGN-IN (OAUTH)
If you choose to sign in with Google, your browser will interact with Google's servers during the OAuth handshake. Google may set its own cookies on accounts.google.com as part of that process. Those cookies are governed entirely by Google's Privacy Policy ↗ — FindMeComics does not control, read, or benefit from them. After the handshake completes, only our session-token cookie (above) is active.
Google Sign-In is entirely optional. You can register and sign in with an email address and password instead, in which case no interaction with Google's servers occurs at all.
THE CONSENT BANNER
On your first visit we show a banner with two options: Accept Analytics (loads PostHog) and Essential Only (session cookie only, PostHog never loads). Your choice is stored in localStorage and respected on every subsequent visit. The session cookie is set regardless of your choice — it is strictly necessary for authentication and falls under the ePrivacy Directive Art. 5(3) / PECR Reg. 6(4) exemption.
MANAGING OR DELETING COOKIES
You can delete or block cookies at any time through your browser settings. If you delete the session cookie you will be signed out. If you block all cookies, sign-in will not work — the session cookie is technically required.
Browser cookie settings guides: Chrome ↗ · Firefox ↗ · Safari ↗ · Edge ↗
CHANGES TO THIS POLICY
If we add new non-strictly-necessary cookies we will update this page, update the “Last updated” date, and implement a proper consent mechanism before setting them.
QUESTIONS
Email privacy@findmecomics.com. See also our full Privacy Policy and Privacy Policy § 12 (Cookies).