Cookie Policy

1. What cookies are

Cookies are small text files placed on your device by your browser when you visit a site. We use cookies and similar storage (e.g. localStorage) to authenticate, remember your preferences, and — where you opt in — measure usage of the marketing site.

2. Consent Mode v2

Hail Pilot implements Google Consent Mode v2 with default-deny pre-grant. This means analytics, advertising, and marketing tags are not loaded into your browser until you affirmatively consent. Essential cookies (session, CSRF, locale) are set without consent because they are required for the Service to function and the Service cannot operate without them.

You can review and change your consent at any time via the cookie banner footer link, or by clearing cookies and reloading the page.

3. Cookie categories

3.1 Essential (always on)

Required for authentication and the Service to function. Not subject to consent; cannot be disabled.

• session — HttpOnly, Secure, SameSite=Lax. Holds your server-side session identifier. Expires on logout or after 14 days.
• _csrf — readable cookie used by the double-submit-cookie CSRF protection. Expires on logout.
• hp_locale — your selected locale (en / zh / ms / id / th / fil). 1-year expiry.
• session_exists — non-HttpOnly marker letting the frontend route un-authenticated users without a round-trip. Mirrors the session cookie lifecycle.

3.2 Analytics (opt-in)

Set only after you grant analytics consent. Used to understand traffic and improve the marketing site.

• PostHog — product analytics. ph_* cookies. Expiry up to 1 year.
• Microsoft Clarity — heatmaps and behaviour analytics on marketing pages only (never on /dashboard or /flightdeck).
• Google Tag Manager — tag-management container. Loads downstream tags only with consent.

3.3 Marketing (opt-in)

Set only after you grant marketing consent. Used by ad platforms to attribute conversions.

• LinkedIn Insight Tag — conversion tracking and audience building.
• Meta Pixel — conversion tracking and audience building.

3.4 Preferences (opt-in)

• Theme preference (light / dark / system).
• UI state (sidebar collapsed, last-visited dashboard tab).

4. How to control cookies

In-product:

• On first visit, use the cookie banner to grant or deny analytics + marketing consent.
• Subsequently, open the “Cookie preferences” link in the footer to change your choices.

In your browser:

• Most modern browsers let you block all cookies, block third-party cookies, or delete cookies on close. See your browser's help docs.
• Blocking essential cookies will break authentication and the Service.

5. GDPR-specific notes

Where you access the Service from the European Economic Area or the UK, we rely on your affirmative consent (GDPR Article 6(1)(a)) as the legal basis for non-essential cookies. Consent can be withdrawn at any time without affecting prior lawful processing. Essential cookies are processed under our legitimate interest in providing the Service (Article 6(1)(f)) and our contractual necessity (Article 6(1)(b)).

6. Updates

We may update this Cookie Policy as we add or remove cookies. Material changes trigger a fresh consent prompt.

7. Contact

Questions: dpo@hailpilot.com.