Cookie Policy
Last updated: 23 October 2026
The statement
This website sets no tracking cookies. We measure visits without cookies, and nothing about your visit is kept in your browser to follow you.
The few cookies you may get here are strictly necessary: one security cookie from our host's network on every page, and the cookies of our booking tool, Cal.com, if you open it to book a call. None of them tracks you, so none of them needs your consent. They are all listed below.
What this means
One security cookie from our host
Our host, Sevalla, serves the site through Cloudflare's network. On every page, Cloudflare places the cookie below to tell real visitors apart from bots and keep the site secure. It is strictly necessary, so it is set without asking for your consent. It is the only cookie set on our own domain, and we don't use local storage or any similar technology to keep data in your browser between visits.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
__cf_bm | heka.design, via Cloudflare | Tells real visitors apart from bots to protect the site | 30 minutes |
Audience measurement, without cookies
We use PostHog to understand how the site is used: which pages are viewed, what gets clicked, how fast pages load, and which technical errors occur. It runs in cookieless mode. Nothing is stored on your device, your browser is given no identifier, and session recording is off. We don't use this data for advertising and we don't share it with anyone for that purpose. Where it is processed is covered in our Privacy Policy.
Booking a call with Cal.com
You can book a call through Cal.com on the contact page and on the pages we prepare for a specific company. The booking tool loads only when you open the booking window. From then on, Cal.com places the cookies below on its own domain. They are strictly necessary for the booking tool to work securely, so they are set without asking for your consent.
| Cookie | Set by | Purpose | Duration |
|---|---|---|---|
__cf_bm | cal.com, via Cloudflare | Tells real visitors apart from bots to protect the booking service | 30 minutes |
__Secure-next-auth.csrf-token | cal.com | Protects the booking form against forged requests | Until you close your browser |
__Secure-next-auth.callback-url | cal.com | Keeps navigation inside the booking tool working | Until you close your browser |
uid | app.cal.com | Session identifier that keeps your booking session together | Until you close your browser |
What you type into the booking form is covered in our Privacy Policy.
The contact form
When you submit the contact form, you send us the details you entered so we can reply. Before it is sent, Cloudflare Turnstile runs a quick check to tell people apart from bots. It sets no cookie, but its check, which runs in a frame on Cloudflare's own domain, keeps one entry in that frame's local storage. It is strictly necessary for the spam check, so it is stored without asking for your consent. How we handle that data is covered in our Privacy Policy.
| Storage | Set by | Purpose | Duration |
|---|---|---|---|
cf.turnstile.u (local storage) | challenges.cloudflare.com | Used by Turnstile to run its check that the form is sent by a person | Until you clear your browser data |
If this ever changes
If we add anything that would need your consent, we'll update this page first and ask you before anything is stored on your device.
A question about privacy on this site? Write to hello@heka.design.