Cookie Policy
Anonymity doesn’t mean we use no cookies — it means your employer can never see who said what. This page explains the few cookies we do use and how you control the non-essential ones.
Last updated: 6 July 2026
1. What cookies are
Cookies are small files a website stores on your device. We also use similar technologies, such as your browser’s local storage. We group them as strictly necessary (the site can’t work without them), functional (remembering your choices), analytics (helping us understand and improve the site), and advertising (measuring our ad campaigns so we don’t waste them on the wrong people). Analytics and advertising cookies stay off until you accept them, and we never use cookies to sell your personal data.
2. Our approach
We keep cookies to a minimum. Strictly-necessary and functional cookies are first-party and simply run the product. Anything that uses cookies or could identify you — analytics like Ahrefs, Google Analytics, and PostHog, and advertising like Google Ads, our own attribution cookie, and the Rewardful partner-referral cookie — sets no cookies and can’t identify you until you accept it in our cookie banner (Google’s tag uses Consent Mode: it may load in a cookieless state, but stores nothing and identifies no one until you opt in). We treat analytics and advertising as a single choice: accepting in the banner turns both on, declining keeps both off. The one thing that runs by default is Vercel’s cookieless, aggregate measurement of page performance, which sets no cookie and doesn’t identify you. The anonymous survey pages your team fills in set no cookies and carry no advertising pixels, identifying analytics, or fingerprinting — only that same cookieless page-performance measurement.
3. Cookies and similar technologies we use
Here’s what we use and why. The names and lifetimes of our authentication provider’s cookies are set and managed by Clerk and may change.
| Cookie / technology | Provider | Category | What it does | Expiry |
|---|---|---|---|---|
| __client_uat, __session (and related) | Clerk | Strictly necessary | Keep you signed in and secure the dashboard. Set only on authenticated areas. | Set and managed by Clerk |
| sh_consent | StaffHero | Strictly necessary | Remembers your cookie choice so we don’t ask again. | 1 year |
| Demo-mode & interface preferences (e.g. sh_demo_mode, last-viewed heatmap segment) | StaffHero | Functional | Remember that you’re exploring in demo mode and small interface choices in the app. | 12 hours – 1 year |
| Ahrefs Web Analytics | Ahrefs | Analytics (non-essential) | Aggregate marketing-site traffic, so we can see what’s useful. Loads only after you accept. | Per Ahrefs |
| Google Analytics 4 (_ga, _ga_<id>) | Analytics (non-essential) | Aggregate marketing-site and signup-flow traffic, and where visitors arrive from, so we can see what’s working. Uses Google Consent Mode: the tag may load in a cookieless state but sets no analytics cookie or identifier until you accept. Never on survey pages. | Up to 2 years | |
| PostHog | PostHog | Analytics (non-essential) | Product and marketing analytics across our website and the signed-in app — never on survey pages. Includes click and scroll heatmaps and session replay, with all text and form inputs masked. Stored in your browser’s local storage, not cookies, and only after you accept. | Local storage |
| Google Ads (_gcl_au conversion linker, plus _gcl_aw / _gcl_dc / _gcl_gb) | Advertising (non-essential) | Measures which ads lead to a signup or purchase and, where we enable it, builds retargeting audiences. Uses Google Consent Mode: the tag may load in a cookieless state but sets no advertising cookie or identifier until you accept. The conversion-linker and click-id cookies are first-party; Google may also set cookies on its own domains once you accept. Never on survey pages. | Up to 90 days (first-party); per Google | |
| sh_attribution | StaffHero | Advertising (non-essential) | Remembers the ad click (Google click id) and campaign you arrived from so a later signup can be credited to the right ad. First-party; set only after you accept. | 90 days |
| Rewardful | Rewardful | Advertising (non-essential) | Referral attribution for our partner & affiliate program: remembers which partner’s link brought you here so a later purchase credits them. First-party; loads only after you accept. Never on survey pages. | 90 days |
| Vercel Analytics | Vercel | Analytics (cookieless) | Privacy-friendly page and performance metrics. Sets no cookie. | — |
4. Your choices
When you first visit, our banner lets you accept or decline non-essential cookies — analytics and advertising together, as a single choice. You can change your mind at any time using the “Cookie settings” link in the footer; your choice is remembered for a year. Strictly-necessary cookies are always on because the site can’t function without them.
Because the analytics and advertising that use cookies or identify you stay off until you accept them, you’re private by default. You can also block or delete cookies in your browser at any time — though blocking strictly-necessary cookies may stop parts of the dashboard from working. We don’t rely on Global Privacy Control or Do-Not-Track browser signals; instead, nothing that uses cookies or identifies you runs unless you choose to opt in.
5. Changes & contact
We may update this policy as our cookies or providers change; we’ll update the “last updated” date above. The providers listed here, with what they process and where, are on our Subprocessors page, and how we handle personal data generally is in our Privacy Policy. Questions: hello@staffhero.com.
Related: Privacy · Terms · Cookies · DPA · Subprocessors · Refund · Security