Cookie Notice
Last updated: July 2026
1. About this notice
This Cookie Notice explains how 8x Social, Inc., a Delaware corporation ("8x," "we," "us") uses cookies and similar browser-storage technologies on the 8x web platform (the "Platform"). It supplements, and should be read together with, our rep & applicant privacy notice (see privacy-notice-reps.md).
Scope of users. The Platform is used by sales representatives engaged as independent contractors and by applicants who sign up to be considered as such. This notice addresses the cookies set in those users' browsers when they access the Platform. It does not address prospects' personal data (prospects do not visit the Platform); for how 8x handles prospect personal data, see privacy-notice-prospects.md and the cold-call disclosure (see call-recording-disclosures.md).
Summary. 8x uses first-party cookies that are strictly necessary or functional to run the Platform. Analytics — our product analytics (PostHog) and Google Analytics — load only if you accept them through our cookie banner. If you decline, or have not yet chosen, no analytics cookies are set; if you decline, PostHog keeps only a privacy-preserving, non-identifying count (no cookies, no device storage). We do not use advertising, retargeting, or cross-site marketing trackers. You can change your choice at any time (see Section 6).
Controller and contact. The controller responsible for the personal data processed via these cookies is 8x Social, Inc., a Delaware corporation, 1111B S Governors Ave STE 47647, Dover, DE 19904, United States. For privacy questions, contact our Privacy Team at privacy@8x.social.
2. What cookies are
A cookie is a small text file stored in your browser when you visit a website. Cookies can be:
- First-party (set by the site you are visiting — here, the 8x Platform) or third-party (set by another domain). 8x's own cookies are first-party. If you accept analytics, Google Analytics additionally sets cookies associated with Google as a third party.
- Session (deleted when you close your browser) or persistent (stored until they expire or you delete them).
- Strictly necessary / essential (required for the site to function and for you to log in securely), functional (remember your preferences or context), analytics (measure usage), or advertising (track you for marketing). 8x uses strictly-necessary and functional cookies always, and analytics (PostHog product analytics and Google Analytics) only with your consent. We use no advertising cookies.
Some of the values below use the __Host- prefix. This is a security hardening measure: a __Host--prefixed cookie is sent only over HTTPS, scoped to the exact origin that set it, and cannot be set or overwritten by subdomains. It does not make the cookie a tracker.
3. Cookies we use
The essential and functional cookies below are first-party, set by the 8x Platform itself. Analytics — PostHog product analytics and Google Analytics — load only after you accept through the cookie banner. We set no advertising or cross-site marketing cookies.
| Cookie | Category | Purpose | Set by | Duration |
|---|---|---|---|---|
| Supabase authentication session cookies | Strictly necessary (essential) | Keep you securely logged in. These cookies carry your authenticated session so the Platform knows who you are on each request and can enforce access controls. Without them you cannot sign in or use the Platform. | 8x (via our authentication provider, Supabase — see sub-processors.md) | Session / the lifetime of your authenticated session |
__Host-8x_view_as_rep | Functional / essential to an administrative feature | Records that an authorized 8x administrator is using the "view as rep" impersonation tool to see the Platform as a particular representative would. It is set only when an admin activates that feature and governs which view is rendered. It is not a tracking or profiling cookie. | 8x | Session / cleared when impersonation ends |
__Host-displayLocale | Functional | Remembers your selected display language / locale preference (i18n) so the interface renders in your chosen language across visits. | 8x | Persistent (until you clear it or change your language preference) |
__Host-li_oauth_state | Strictly necessary (security) — NOT ACTIVE | A CSRF anti-forgery state value reserved for LinkedIn OAuth/OIDC sign-in. This flow is not live. LinkedIn OAuth is currently a non-functional stub (it returns an HTTP 501 and does not run), so this cookie is not set in normal use today. It is documented here for transparency and will become active only if and when LinkedIn sign-in is enabled, at which point it will be set transiently during the sign-in handshake and discarded immediately afterward. | 8x | Transient (during a sign-in handshake) — not currently issued |
8x-cookie-consent (browser localStorage) | Strictly necessary (records your choice) | Stores whether you accepted or rejected analytics cookies, so we do not ask again and analytics stays off unless you accepted. Clearing it re-shows the banner. | 8x | Persistent (until you clear site data) |
ph_…_posthog | Product analytics (first-party) | Set by PostHog, our product-analytics provider, to understand how the Platform is used so we can improve it. Set only after you accept through the cookie banner; if you decline, PostHog sets no cookies or storage and keeps only a privacy-preserving, non-identifying count. Session recording is configured for maximum privacy — all text and form inputs are masked, so names, emails, phone numbers, and lead data are not captured. Served first-party via the 8x origin. | 8x (via PostHog — see sub-processors.md) | Persistent (about 1 year) — only if you accept |
_ga, _ga_<stream-id> | Analytics (third-party — Google) | Google Analytics 4. Distinguishes visitors and sessions to measure site usage. Set only after you accept analytics via the cookie banner; if you decline or have not chosen, Google Analytics does not load and these cookies are never set. | 8x (via Google — see sub-processors.md) | Persistent (up to 2 years) |
The Supabase authentication session is implemented as first-party cookies on the 8x origin; no third-party Supabase-domain cookie is set in your browser.
4. Analytics and your consent
We use analytics to understand how the Platform is used so we can improve it, and we handle it as follows:
- Google Analytics (third-party): Loaded only after you accept through the cookie banner. Until you accept, the Google Analytics script is not loaded at all and sets no cookies (this is Google's "basic" consent mode). You can decline as easily as you can accept, and you can change your mind later (Section 6).
- Product analytics (PostHog, first-party): Loaded only after you accept through the same cookie banner. Until you accept, PostHog captures nothing and sets no cookies or storage. If you decline, PostHog keeps only a privacy-preserving, non-identifying count of visitors who declined (a server-side hash — no cookies, no device storage, no personal data). Event capture and session recording run only after you accept, and session recording is configured for maximum privacy (all text and form inputs are masked, so readable personal data is not captured).
- No advertising, marketing, retargeting, or cross-site tracking technologies, social-media pixels, fingerprinting, or data-broker tags are present.
Jurisdiction-specific note. Cookie/consent rules differ by market:
- EU / UK (ePrivacy): Storing or reading information on a user's device generally requires prior consent except for cookies that are strictly necessary to provide the service the user has requested. EU/UK is in scope — GDPR and the ePrivacy Directive apply (see privacy-notice-reps.md, "International transfers" / territorial scope). Google Analytics and PostHog product analytics are therefore gated behind opt-in consent and are not loaded or activated unless you accept (if you decline, PostHog keeps only a cookieless, non-identifying count). The functional cookies (locale preference, impersonation) are disclosed in this notice.
- US (CCPA/CPRA): We do not use cookies for the "sale" of personal information or for cross-context behavioral advertising. We maintain a CCPA-ready disclosure in privacy-notice-reps.md.
- Brazil (LGPD), Mexico, India (DPDP): Analytics is used as described above; we rely on this notice and, for Google Analytics and PostHog, on your opt-in consent, and address any additional local requirements through our broader privacy program.
5. Our commitment when analytics changes
Consistent with the commitment in earlier versions of this notice, when we introduced analytics (Google Analytics, and when we brought PostHog product analytics under the same banner) we, at deployment:
- Updated this Cookie Notice to describe each service, its purpose, the recipients (Google and PostHog), and its duration; and
- Implemented a consent mechanism — a cookie banner that loads analytics only on acceptance, with reject offered as easily as accept, and the ability to change your choice (Section 6).
For any future non-essential cookie or tracking technology, we will apply the same two steps before, or at the point at which, we rely on it, and honor opt-out preferences where opt-out is the applicable standard.
6. Managing cookies and your analytics choice
Withdrawing or changing analytics consent. To withdraw consent for analytics (Google Analytics and PostHog) after accepting (or to change an earlier choice), clear this site's stored data in your browser. That removes the 8x-cookie-consent preference and re-shows the banner; analytics does not load again until you accept.
Essential and functional cookies are required for the Platform to work — in particular, blocking the authentication session cookies will prevent you from logging in.
You can control or delete cookies through your browser settings. Most browsers let you view stored cookies, delete them, and block cookies from specific sites. See your browser's help documentation (Chrome, Firefox, Safari, Edge) for instructions. Note that clearing cookies will sign you out, reset your saved locale preference, and reset your analytics choice.
Cross-references: privacy-notice-reps.md · privacy-notice-prospects.md · sub-processors.md