Cookie Policy

1. Our approach

We don't like cookie banners, so we built Provisore to need as little of one as possible. We set no advertising or cross-site tracking cookies anywhere, and nothing we load profiles you across other websites. Measuring how the product is used stores nothing on your device unless you agree to it, so the one thing we ask about is whether that measurement may be linked to your account. The answer is remembered, so we only ask once. Section 4 lists exactly what a page loads from a third party and what it sends; section 5 covers the ask.

2. Strictly necessary cookies

The application (app.provisore.com) sets only cookies that are strictly necessary to operate the service:

• provisore_session. Keeps you signed in. Expires after 30 days of inactivity.
• provisore_csrf. Protects forms against cross-site request forgery. Session-scoped.

3. Local storage

We use browser local storage for interface preferences (theme, collapsed panels) and for your answer to the analytics question in section 5. This is local storage, not cookies, and it is not sent to any other site.

PostHog stores an identifier here only if you agreed to analytics being linked to your account. Without that agreement it holds its identifier in memory for as long as the tab is open and writes nothing at all; if you later withdraw, the stored identifier is deleted immediately. Signing out clears it too, so the next person to use the browser starts fresh.

4. Third parties

Three third parties run code or receive requests from your browser:

• PostHog (EU Cloud, Germany). Loaded on every page, including marketing pages. It does two jobs: it decides which features are enabled for you, and it records how the product is used so we can tell which parts of it work. It sends to provisore.com/ingest, a relay on our own domain that passes each request, with your IP address, to eu.i.posthog.com, so your IP address and page URL reach PostHog's EU servers; PostHog derives your country and then discards the address rather than storing it. We configure it to set no cookies (it uses local storage). Autocapture and session recording are both off: PostHog does not read the page. It never sees what you clicked on, what you typed, or anything else on screen, which in this product routinely means a database password, a deploy key, an environment file or a line of terminal output. What it does see is a fixed list we wrote by hand: the address of the page you opened (with the query string removed, because our email links carry single-use tokens in it), and an entry for each of a set of product actions such as creating a server, starting a deploy or opening a database. Those entries carry only low-detail facts about the action (that a database was a PostgreSQL one, that a deploy was triggered by a push) and never a name, a domain, a search term or a value you typed. Anything that looks like a key, token or password is stripped in your browser before sending, on the same rules Sentry's reports use. When the app crashes, the error and its stack trace go to PostHog as well as to Sentry. Whether any of that is connected to you is the question section 5 asks. Until you say yes it is entirely anonymous: PostHog keeps its identifier in memory rather than on your device, no profile is created, no name or email address is sent, and two visits from you cannot be joined together. If you agree, the identifier moves into local storage so a returning visit is recognised, and a profile is created holding your name, email address, and the name and plan of your team. You can withdraw at any time under Account settings → Product analytics, or with the control in section 5, and we stop and delete the identifier the moment you do.
• Sentry (EU region, Germany). Loaded on every page, but silent unless something breaks. When the app throws an error it sends a report to de.sentry.io, which means your IP address reaches Sentry's EU servers at that moment. It sets no cookies and stores nothing on your device. We turn session replay off entirely, so your screen is never recorded, and the report is filtered in your browser first: request and response bodies, authorisation and cookie headers, and URL query strings are stripped, and anything that looks like a key, token or password is replaced before sending. Routine responses such as an expired session or a validation failure are not reported at all.
• Stripe. During checkout only. Stripe sets cookies required for fraud prevention on its own domains, governed by Stripe's cookie policy.

5. Consent

We ask you one thing, once: may the usage measurement described in section 4 be linked to your account?

We ask because that is the point at which something is stored on your device: an identifier that lets us recognise a returning visit. Storing anything on your device is what the ePrivacy rules, as implemented in Denmark, require consent for. Everything we do without that agreement stays outside it: the strictly necessary session and CSRF cookies, your interface preferences, your answer to this question, and anonymous measurement that writes nothing at all. None of it is used for advertising, and none of it recognises you on any other website.

Declining costs you nothing. The product is identical either way, and we would rather have honest measurement from people who agreed than a banner engineered to produce a yes. So "Decline" is the same size as "Accept", takes the same single click, and is remembered just as long.

Change your mind at any time, here:

You can also email privacy@cavas.dk and we will exclude your account entirely. Blocking provisore.com/ingest in your browser stops it too, and the product works the same with it blocked.