#Cookies and storage
Last updated: November 9, 2026
What cookies and similar storage Postra uses. Pairs with the Privacy Policy. The marketing site does not load analytics. Product analytics (PostHog) runs only in the signed-in app, and only when allowed.
#Categories
| Category | What it covers | Consent |
|---|---|---|
| Necessary | Sign-in, security, locale, theme, and other prefs the product needs to work | Always on |
| Analytics | Product usage, errors, and session replay in the signed-in app | Asked where the law requires it; managed in Privacy settings |
We do not use advertising cookies.
#Necessary
| Name / key | Type | Where | Purpose |
|---|---|---|---|
postra_session |
Cookie | Sign-in | Keeps you signed in |
csrf_token_* |
Cookie | Sign-in | Protects sign-in and account forms from cross-site request forgery |
postra.locale |
Cookie | Marketing + app | Language preference |
postra.localePreference |
localStorage | Marketing + app | Same preference, offline mirror |
postra_geo |
Cookie | Signed-in app | Rough region for consent rules (country / GPC hint). Set at the Cloudflare edge from request geo; read only in the browser |
postra.theme |
localStorage | Signed-in app | Light / dark / system |
postra.timeFormat |
localStorage | Signed-in app | Clock format preference |
postra.activeMailboxId |
localStorage | Signed-in app | Last mailbox you used |
postra.recentRecipients |
localStorage | Signed-in app | Recent compose addresses |
postra:reply-draft:… |
localStorage | Signed-in app | Draft reply text while you write |
postra.analytics_consent |
localStorage | Signed-in app | Remembers Accept / Reject for analytics |
postra.consent_prefs |
localStorage | Signed-in app | Detailed consent prefs JSON |
| Abuse / bot checks | Ephemeral | Sign-up and sensitive actions | Proof-of-work challenge tokens plus local browser/device signal hashes used only to detect automation. Hashes stay on Postra; they are not used to permanently ban devices |
Load-balancing and edge cookies from the host or CDN are strictly necessary for routing. They are not used for advertising.
#Analytics (signed-in app only)
| Name / key | Type | Purpose |
|---|---|---|
ph_*_posthog (PostHog defaults) |
Cookie / storage | Product analytics and session replay |
PostHog starts only after analytics is allowed. Session replay masks inputs and skips mail content regions. You can change this anytime in the signed-in app under Privacy settings (/me/privacy).
The marketing website does not set PostHog cookies.
#How to control them
- Analytics: Privacy settings in the app, or Reject on the consent banner where it appears
- Browser: block or clear cookies; blocking necessary cookies can break sign-in and prefs
- Global Privacy Control: when your browser sends GPC, we treat it as a decline for analytics where that regime applies
Questions: [email protected].