Cookie Policy
We keep cookies to a minimum. Only the necessary ones run by default; no analytics cookie is set until you switch analytics on, and you can change your mind at any moment.
Last updated: September 2026
A cookie is a small note your browser keeps for a site. Every cookie sayit sets falls into one of the categories below, the same ones you’ll see in the preferences dialog. Necessary cookies just keep the app working. Analytics is optional: the measurement tags are on the page, but they are held in a state where they set nothing and can’t tell who you are until you opt in.
One thing that is never a cookie
Your voice. Recordings are uploaded securely and tied to your account so we can analyse your speech — they are not stored in cookies, not used for tracking, and no setting on this page affects them. How we handle recordings is covered in our Privacy Policy.
The cookies we use.
Here’s every category, what’s actually in it, and whether it runs by default or waits for your okay. The last one sets no cookie at all — it’s here because it runs on every page and you deserve to know.
Necessary
Always onThe small set we can’t switch off: they keep you signed in, keep your account secure, and remember the choices you make here. Without these, the basics simply wouldn’t work.
- sayit_sessionKeeps you signed in to the app. Cookie, 30 days.
- sayit_csrfProtects forms and actions against cross-site request forgery. Cookie, 30 days.
- sayit-consentRemembers your cookie choices — stored in your browser (localStorage), so we don’t keep asking. We ask again after 180 days, and straight away if we ever add a new tool to the list below.
Analytics
Off — opt-in onlyWhich pages help and which fall flat, so we build the right things next instead of guessing. The Google measurement tags load on every page, but they start switched off: until you opt in they set no cookie, keep no id, and cannot tell who you are. Say yes and the items below start; switch analytics back off and they stop.
- _ga, _ga_YZHC0B10BCGoogle Analytics 4 (measurement id G-YZHC0B10BC; our Google Tag Manager container, GTM-552TW8GS, loads alongside it). Counts visits and which pages get read. Cookies, up to 2 years — written only once you opt in. Google’s advertising and personalisation storage stays denied whatever you choose, so these are never used to build an ad profile.
- ph_… (PostHog)Product analytics — which features get used, in aggregate. Cookie plus localStorage, about a year. Signed in, this is linked to your sayit account; signed out, it is not.
- sayit_vidOur own visitor count. A random id with nothing personal in it, kept in your browser (localStorage) and sent only to our own servers — never to anyone else — so two visits from this browser aren’t counted as two people.
Performance & security
Always on · no cookiesCloudflare sits in front of sayit and serves the site to you. It adds two small scripts of its own to the page, for every visitor, before you have answered anything here — so they are listed even though we don’t choose them per-visit and they aren’t part of our app’s code. Neither one sets a cookie or keeps an id in your browser, which is why there is no switch for them: there is nothing stored to switch off.
- beacon.min.jsCloudflare Web Analytics. Reports how fast the page loaded and which page it was. No cookie, no id, nothing kept between visits — so it can count page loads but cannot follow you from one to the next.
- email-decode.min.jsCloudflare Scrape Shield. Where a page shows an email address, Cloudflare scrambles it in the HTML and this script unscrambles it for real readers, to keep the address away from harvesters. It sets nothing and sends nothing.
How to manage cookies.
The easiest way is the cookie preferences panel, the same one you saw on your first visit. It has a switch for analytics; toggle it and your choice takes effect immediately. You can re-open it any time with the button below.
Prefer to do it in your browser? That works too. Every modern browser lets you view, block, or clear cookies in its privacy or security settings; clearing ours simply resets you to the necessary-only default, and we’ll ask again next time.
About our analytics
Four things count usage here: Google Analytics 4 (with our Google Tag Manager container loading alongside it), PostHog, our own pageview counter, and Cloudflare’s cookieless one. None of them sells your data or builds a cross-site advertising profile — Google’s advertising signals are switched off for everyone, whatever you choose on this page.
The Google tags do load on every page, because that is how they are told your answer. Until you opt in they sit in Google’s denied state: no cookie, no id, nothing that points back to you. PostHog and our own counter don’t start at all until you opt in, and they stop when you switch analytics back off. Cloudflare’s counter is the one you can’t switch off here — it runs at the edge that serves the page, and it keeps nothing in your browser to switch.
Questions about any of this?
Our full privacy policy spells out exactly what we do and don’t collect. If anything’s unclear, a real person will answer.