1. What this policy covers
This policy explains the cookies and similar browser technologies (local storage) used by Postalu Social Hub at postalu.com. It supplements our Privacy Policy.
A cookie is a small text file a website asks your browser to keep and send back. Local storage is a similar space in your browser that is never sent to a server automatically.
2. Cookies we set
| Name | Purpose | Type | Lifetime |
|---|---|---|---|
| postalu_session | Keeps you signed in. HTTP-only (JavaScript cannot read it), SameSite, and Secure in production. Holds a random session identifier, not your personal details. | Strictly necessary, first party | Until you sign out or the session expires |
| postalu_oauth_state_… | Protects the connect-an-account flow against forged requests (CSRF) by tying the return from the platform to the browser that started it. | Strictly necessary, first party | About 10 minutes; deleted on use |
| Account or Page choice (encrypted) | Temporarily remembers the list of Facebook Pages or LinkedIn organisations while you choose which one to connect. Encrypted by our server. | Strictly necessary, first party | A few minutes; deleted on use |
| Google sign-in state | Protects the Sign in with Google flow against forged requests and replay, by tying the return from Google to the browser that started it. | Strictly necessary, first party | About 10 minutes; deleted on use |
| Sign-in progress (two-factor) | Remembers that you passed the password step while you enter your authentication code. | Strictly necessary, first party | A few minutes |
3. Local storage we use
| Item | Purpose | Leaves your browser? |
|---|---|---|
| Theme | Remembers light or dark mode. | No |
| Dismissed notices | Remembers which banners and tips you have closed so they do not return. | No |
| Composer drafts and interface choices | Keeps small conveniences such as the last tab you used. | No |
You can clear this at any time in your browser settings; the application will simply forget those preferences.
4. Third-party cookies
Postalu does not use third-party analytics or advertising scripts. Two things involve other companies. When you connect a social account or sign in with Google you are redirected to that platform's own site (Meta, Google, TikTok, X or LinkedIn). And the payment page (/pay) loads Paddle's checkout, which Paddle operates and which may set its own cookies to process your payment and prevent fraud. These companies set their own cookies under their own policies, which we do not control:
5. Your choices
You can block or delete cookies in your browser. Doing so will sign you out and may stop sign-in and account connection from working, because the cookies above are required for those features. Browser settings for the main browsers are explained at aboutcookies.org.
We do not respond differently to “Do Not Track” or Global Privacy Control signals because we do not track you across sites or sell or share personal information for advertising.
6. Changes and contact
If we ever add a non-essential cookie we will update this page, show the change in the application, and ask for your consent first where the law requires it. Questions: privacy@postalu.com.
Last updated October 12, 2026 · Version 1.1
