1. What Are Cookies?
Cookies are small text files stored on your device by your web browser when you visit a website. They are commonly used to remember preferences, keep you signed in, or track you across sites. Browsers also offer related storage mechanisms such as localStorage, sessionStorage, and IndexedDB.
2. Cookies We Set
Cookies we set (plus Google advertising cookies when ads are active):
| Cookie | Domain | Purpose | Lifetime | Type |
|---|---|---|---|---|
hvpn_acct | api.hourlyvpn.com | Identifies your account for the magic-link sign-in flow. Marked HttpOnly, Secure, and SameSite=Lax so client-side scripts can’t read it and it isn’t sent on cross-site requests. | 180 days, or until you sign out by clearing the cookie | Strictly necessary |
ph_*_posthog | hourlyvpn.com | Anonymous visitor ID used by PostHog so we can stitch a single visitor’s page views together across subdomains and across page reloads (see our Privacy Policy Section 1.8 for the full description). Set as a first-party cookie on the apex so the visitor ID survives www → apex redirects without restitching the session. | ~1 year (PostHog rotates) | Analytics |
_gcl_* / Google Ads cookies | hourlyvpn.com (via Google) | Set by Google when our advertising tag is active, used to attribute visits and conversions to Google Ads campaigns. Loaded only when ads are configured for this site. Suppressed when Do Not Track or Global Privacy Control is enabled. | Per Google’s cookie lifetimes | Advertising measurement |
3. Browser Storage We Use
| Key | Purpose | Lifetime | Type |
|---|---|---|---|
hvpn:home-v1 | sessionStorage: remembers your selected city, plan choice, and acceptable-use checkbox so a page refresh doesn’t lose your selection | Cleared when you close the browser tab | Strictly necessary |
ph_*_posthog | localStorage: session metadata, replay buffer, and feature-flag cache used by PostHog. Backs the larger replay payload that wouldn’t fit in a cookie. Mirrors the visitor ID stored in the cookie of the same name (see Section 2). PostHog runs across the entire Hourly VPN site; the remote browser iframe itself is explicitly excluded from session recording. | Persists until you clear it (or until PostHog rotates it) | Analytics |
The homepage data lives entirely on your device. The PostHog visitor ID is sent to our analytics provider on every page view; if your browser sends a Do Not Track or Global Privacy Control signal, the PostHog SDK short-circuits and nothing is collected. You can clear all of this at any time via your browser’s site-data controls.
4. Third-Party Cookies
4.1 Stripe (when you check out)
When you click "Continue to checkout", you are redirected to a hosted Stripe Checkout page on Stripe’s domain. Stripe sets its own cookies on that page for fraud prevention and session management; those cookies are governed by Stripe’s privacy policy. We do not embed the Stripe SDK on our own site.
4.2 The remote browser itself
When you start a session, the embedded Chromium browser will accept cookies from the websites you visit inside it (e.g. signing into your bank). Those cookies live inside the per-session container and are destroyed when the session ends. We do not persist any browsing cookies between sessions, and we do not read them. Our analytics provider has no visibility into the remote browser: the iframe is on a different origin (so its cookies are inaccessible to anything on hourlyvpn.com), and we additionally mark the iframe to be blocked from PostHog session recording so its URL and any auth token in that URL never enter the replay stream.
5. What We Don’t Use
To be clear about what we do not do:
- No selling of personal data
- No social media cookies or widgets
- No fingerprinting, supercookies, or cross-site tracking for advertising networks
- No sharing of PostHog product-analytics data with advertisers (Google Ads measurement is a separate tag, disclosed above)
- No third-party analytics other than PostHog (described in Section 2 above and Section 1.8 of our Privacy Policy)
- No recording inside the remote browser. The PostHog SDK can’t see across the iframe boundary (different origin) and we additionally mark the iframe to be blocked from session recording, so its URL, the auth token in that URL, and the page contents you load inside it are all excluded from replays
The PostHog session replay does record mouse movements, scrolls, and clicks on Hourly VPN’s own UI (homepage, sign-in, checkout, account, the in-session control surface), but every form input is masked by default, so the email you type at sign-in, the city you pick, and any other typed content are not captured.
6. How To Opt Out
Analytics and advertising measurement cookies in Section 2 are not strictly necessary. We honor three opt-out paths; Do Not Track and Global Privacy Control each stop both PostHog and the Google Ads tag for your visit:
- Enable Do Not Track (DNT) in your browser. We detect DNT and short-circuit before PostHog or Google Ads tags initialize. Most browsers expose this under privacy settings; some (Safari, recent Firefox) have removed the global toggle in favor of the GPC option below.
- Enable Global Privacy Control (GPC). GPC is a newer, machine-readable opt-out signal recognized by California, Colorado, and Connecticut law as a valid opt-out request. We check for it before initializing PostHog or Google Ads, so a GPC visitor never sets those cookies or fires measurement events. Browsers and extensions with built-in GPC support are listed at globalprivacycontrol.org.
- Block first-party cookies for hourlyvpn.com. All major browsers let you block cookies globally or per site. Blocking the
ph_*_posthogcookie disables PostHog visitor stitching; the rest of the Service still works without it. Blocking thehvpn_acctcookie will sign you out and prevent you from using paid sessions.
You can also clear cookies, localStorage, sessionStorage, and other site data at any time from your browser settings, or use private / incognito browsing to keep nothing across sessions. The dismissible cookie notice at the bottom of the page is a disclosure, not a consent gate; clicking "Got it" only hides the notice and does not change what we collect. The opt-out paths above are the actual control.
7. Changes to This Policy
If we start using additional cookies or similar technologies, we will update this policy and implement appropriate consent mechanisms as required by law. The "Last updated" date at the top of this page indicates when it was last revised.
8. Related Policies
For more detail on how we handle data generally, see our Privacy Policy. For the rules of using the Service, see our Terms of Service.
9. Contact
If you have questions about our use of cookies or browser storage, contact us at privacy@hourlyvpn.com. Sezi LLC is the controller for this site. Hourly VPN is a trade name of Sezi LLC.