Cookie Policy
Last updated: 27 October 2026
1. In short
Without your consent this site uses no cookies. In session storage (sessionStorage) it keeps only what the features you use need: your conversation with the Broski chat, the fact that you closed its invitation, and your scroll position. These entries disappear when you close the tab and are not used for analytics. Analytics runs in cookieless mode, where a hash computed on EU servers replaces any identifier kept on your side. That is why we do not ask about analytics. The banner asks only about Meta and Google advertising cookies (section 3a): without consent they are not loaded at all. Other cookies appear only in the app at app.brosbots.com: the ones needed to sign in straight away, analytics ones only if you accept them in the app’s banner. They are described in section 4.
2. What cookies and browser storage are
A cookie is a small file a site stores in your browser and sends back with later requests. localStorage and sessionStorage work similarly - the data stays on your device, but is not sent to the server automatically. The law treats both the same way, which is why we describe them together.
3. What we use on brosbots.com
| Name | Type | What it does | How long |
|---|---|---|---|
| PostHog | No cookies, no device storage | Visit analytics: which sections you view, which buttons you click (“start free”, “call the bot”) and whether the page throws errors. It runs cookieless - instead of an identifier in your browser, PostHog computes a privacy-preserving hash on its own side. Servers in the European Union (eu.i.posthog.com). We do not record sessions on this site. | Up to 12 months (on PostHog’s side) |
| A/B test variant | In-memory only | Remembers which of the two homepage button variants you were shown, so it does not change mid-visit. Held purely in the open tab’s memory - nothing is written to disk. | Until you reload the page |
| bb_analytics_off | localStorage - record of your choice | Created only if you switch analytics off yourself in section 7. It is how we remember your objection and skip starting PostHog on later visits. If you never touch that switch, this entry does not exist. | Until you reverse the choice or clear site data |
| broski-chat-v1 | sessionStorage - strictly necessary | Holds your conversation with the Broski chat (your messages, the replies and a random conversation ID) so it survives moving to another page. The entry is created when the chat first loads on the page, even before you type anything. Message content reaches us only once you send it. | Until you close the tab |
| broski-teaser-seen | sessionStorage - functional | Remembers that you closed the Broski chat invitation, so it does not pop up again during the same visit. | Until you close the tab |
| brosbots:scroll:* | sessionStorage - functional | Remembers how far you scrolled a page, so the Back button returns you to the same spot. It stores only the page address and a pixel count. | Until you close the tab |
| Vercel Web Analytics | No cookies, no device storage | Aggregate visit statistics (page views, country, referrer, CTA clicks). It does not create an identifier that would let us recognise you on a later visit. | Not applicable |
| Vercel Speed Insights | No cookies, no device storage | Page load performance measurement (Core Web Vitals), so we can spot pages that are slow. | Not applicable |
We do not store your language choice in a cookie - the Polish or English version is picked once from your browser settings (the Accept-Language header), and you can override it by going to /pl or /en directly.
3a. Advertising cookies (consent only)
We advertise BrosBots on Facebook, Instagram and Google Search. If you click “Accept” in the banner, we load the Meta Pixel and the Google Ads tag. They send Meta and Google information about your visit (IP address, browser, pages visited, the cookie identifiers below) and about two events: starting a demo call and - in the app - confirming a new account. We do not pass them your e-mail address, phone number or the website address you entered in the demo. Meta and Google also process this data for their own purposes, under their own privacy policies. If you click “Reject” or do not answer, none of it is loaded.
| Name | Type | What it does | How long |
|---|---|---|---|
| bb_consent | Cookie - record of your choice | Remembers whether you accepted or refused advertising cookies in the banner, so it does not come back on every visit. Set for the whole .brosbots.com domain, because the app relies on the same choice when it reports a sign-up as an ad conversion. | 6 months |
| _fbp, _fbc | Meta cookie - advertising, consent only | Meta Pixel (Meta Platforms Ireland Ltd.): measures whether a visit from a Facebook or Instagram ad ended in a demo call or a sign-up, and lets us show our ads to people who visited the site. _fbc is created only when you arrive from an ad click. | 90 days |
| _gcl_au, _gcl_aw | Google cookie - advertising, consent only | Google Ads tag (Google Ireland Ltd.): measures whether a click on a Google Search ad ended in a demo call or a sign-up, and lets us show our ads to people who visited the site. _gcl_aw stores the ad click ID. | 90 days |
4. What we use in the app (app.brosbots.com)
| Name | Type | What it does | How long |
|---|---|---|---|
| Session and sign-in cookies | Cookie - strictly necessary | Keeping you signed in and protecting forms. The app does not work without them, so they do not require consent. | Session, or until you sign out |
| PostHog (ph_*) | Cookie + localStorage - analytics, consent only | Product analytics: which app screens get used, where users get stuck, what errors they hit. Without consent PostHog runs only in the open tab’s memory: it collects basic statistics, stores nothing on your device and records no sessions. Once you consent in the app’s banner it stores an identifier in a cookie and localStorage and collects heatmaps, browser console messages and session recordings, i.e. a replay of what was on screen, including content shown in the app (form fields are masked). Data is sent through the /ingest path on the app’s own domain, from where it goes to PostHog servers in the European Union (eu.posthog.com). | Events up to 12 months, session recordings 30 days; the cookie until you withdraw consent |
| brosbots_analytics_consent | localStorage - record of your choice | Remembers whether you accepted analytics in the app’s banner or chose essential only, so the banner does not come back on every visit. | Until you change the choice or clear site data |
| Sentry | No cookies | Application error monitoring. When something breaks, a technical report is sent (error type, browser, page URL). Sentry stores nothing in your browser. | Not applicable |
| Stripe | Cookie - necessary at checkout | Payment handling and fraud detection. Set only on Stripe checkout pages, under Stripe’s own policy. | Per Stripe’s policy |
If you accept analytics in the app, the PostHog cookie is set for the whole .brosbots.com domain, so it can also be visible on the marketing site. The marketing site neither creates nor uses it - its analytics is cookieless and is not joined to your account. Withdrawing consent in the app deletes that cookie straight away.
5. Voice demo, widget and chat
The call widget on the homepage loads a script from BrosBots servers. Until you start a call it does not request microphone access and sends no audio. Once a demo starts we process the audio so the agent can reply - the rules are described in the privacy policy. The “call me” form sends the mobile number and e-mail you enter to our server: the number so the demo agent can place a single call, the address so we can follow up about the demo. The form stores nothing in your browser. The Broski chat passes the messages you send through our server to an automation server (n8n) and a language model that writes the reply.
6. Legal basis
- Access to information stored on your device is governed by Articles 398-399 of the Polish Electronic Communications Law, implementing the ePrivacy Directive.
- Data required to deliver the service (session, sign-in, security, payment) is processed without consent - under Article 6(1)(b) GDPR and the strictly-necessary exemption.
- Consent is required when a site stores or reads information on your device, unless that is strictly necessary for a service you asked for. Without consent this site stores only such strictly necessary data in sessionStorage (section 3), and analytics runs without storing anything on your device, so we do not ask about analytics. We deliberately chose cookieless mode over a box to click away.
- The analytics processing itself (IP address, browser type, pages visited) rests on legitimate interest (Article 6(1)(f) GDPR), namely improving the site. It serves neither advertising nor profiling, and section 7 lets you switch it off.
- In the app, cookies strictly necessary to deliver the service are used without consent. Analytics cookies, session recordings and click heatmaps are switched on only with your consent (Article 399 of the Electronic Communications Law and Article 6(1)(a) GDPR), given in the app’s banner. Both answers are equally easy, and declining does not limit the app.
- Advertising cookies (section 3a) and passing data to Meta and Google rest solely on your consent (Article 399 of the Electronic Communications Law and Article 6(1)(a) GDPR). For collecting and passing on that data we are joint controllers with Meta Platforms Ireland Ltd. and Google Ireland Ltd. (CJEU C-40/17 Fashion ID); they are responsible for any further processing themselves. Data may be transferred to the USA under the EU-US Data Privacy Framework. You can withdraw consent at any time in section 7, without affecting the lawfulness of processing before withdrawal.
7. How to control this
You do not need to switch analytics off to avoid cookies - it creates none. If you would rather not be counted anyway, switch it off here. That click writes one lasting entry to your browser (bb_analytics_off), so we remember your decision on later visits:
You can change your advertising-cookie consent (section 3a) here. Withdrawing it deletes the Meta and Google cookies on this domain straight away and reloads the page without their tags:
- Your browser settings let you block or delete cookies and site data - in Chrome, Firefox, Safari and Edge this sits under privacy settings.
- Blocking cookies will not affect browsing brosbots.com, but it will make signing in to the app impossible.
- Private browsing clears everything above when you close the window - including the record of your objection, so analytics will be back on your next visit.
- In the app you can change your analytics consent at any time with the “Analytics cookies and session recordings” switch under Privacy and data. Switching it off deletes the stored analytics cookies straight away.
- To have analytics data collected in the app deleted, write to kontakt@brosbots.com - we handle it as a GDPR request.
8. What we do not do
- We load no advertising pixels or ad-network tags without your consent. With consent we load only the Meta Pixel and Google Ads (section 3a); we use no other networks, such as LinkedIn.
- We do not combine your visit data with data from third-party brokers, and we do not sell data.
- We do not profile visitors ourselves, nor make automated decisions about them with legal effect. Showing ads again to people who visited happens only with consent, and on Meta’s and Google’s side.
9. Changes and contact
We update this policy whenever the set of technologies we use changes; the date of the last change is at the top of this page. Questions about cookies and personal data: kontakt@brosbots.com. Full processing rules are set out in the privacy policy.