This Cookie Policy explains what cookies and similar tracking technologies Field Read uses, where they run, and how you can control them. It supplements our Privacy Policy and should be read alongside it.
1. What Are Cookies?
Cookies are small text files placed on your device when you visit a website. They are widely used to make sites work, remember your preferences, and provide analytics to site operators.
Similar technologies include:
- Local storage / session storage — browser-based key-value stores that persist data without expiry (local storage) or until your browser tab closes (session storage)
- Fingerprinting signals — browser or device characteristics (user-agent, screen resolution, timezone, etc.) processed by third-party scripts to identify sessions without a persistent cookie
Where this policy uses "cookies" it covers all of these unless stated otherwise.
2. Who This Policy Applies To
This policy applies to everyone who visits any part of fieldread.ai, including:
- Authenticated platform users — logged-in workspace owners and members
- Unauthenticated visitors — people browsing the marketing site, docs, or pricing pages
- Respondents — people who receive a shared Question link and visit
/q/[id]to submit a response without creating an account
The respondent page (/q/[id]) receives visitors who have no prior relationship with Field Read. We call out where specific tools run on that page because these visitors have had no opportunity to create an account or interact with a consent banner prior to arriving.
3. Cookie Categories
We group cookies into four categories. The first is always active; the others depend on your consent where consent is required.
| Category | Always active? | Purpose |
|---|---|---|
| Strictly necessary | Yes | Core platform functionality — session authentication, CSRF protection, rate limiting, bot detection |
| Analytics | Consent required (EU/UK) | Understanding how people use the platform so we can improve it |
| Security & monitoring | Yes (legitimate interest) | Error detection and debugging; does not build user profiles |
| Third-party functional | Consent required (EU/UK) | OAuth provider scripts loaded on the login page |
4. Cookies and Technologies We Use
4.1 Strictly Necessary
These are essential to operate the platform. They cannot be disabled without breaking core functionality.
Session Authentication
| Name | Provider | Type | Expiry | Purpose |
|---|---|---|---|---|
next-auth.session-token | Field Read (Next.js / NextAuth) | HTTP-only cookie | 30 days (rolling) | Maintains your authenticated session |
next-auth.csrf-token | Field Read | HTTP-only cookie | Session | CSRF protection on form submissions |
next-auth.callback-url | Field Read | Cookie | Session | Stores redirect destination after OAuth login |
__Secure-next-auth.* | Field Read | HTTP-only, Secure | Mirrors above | Secure variants used in production (HTTPS) |
Rate Limiting
Rate-limiting state is stored in Upstash Redis server-side. No cookie is written to your browser for this. A sliding-window counter keyed to your IP address is stored for up to 24 hours, then discarded.
4.2 Security and Error Monitoring
Google reCAPTCHA v3
reCAPTCHA v3 runs on the respondent submission page (/q/[id]) to detect automated bot submissions. It runs invisibly — there is no checkbox or challenge presented to users.
| Name | Provider | Type | Expiry | Purpose |
|---|---|---|---|---|
_GRECAPTCHA | Cookie | 6 months | Session token for reCAPTCHA challenge state |
reCAPTCHA v3 also reads passive browser signals (user-agent, screen dimensions, interaction timing) to compute a risk score. This data is processed by Google according to Google's Privacy Policy. Field Read receives only the risk score — we do not receive the underlying signals.
Why reCAPTCHA runs on the respondent page without prior consent: We classify reCAPTCHA v3 as strictly necessary for security. The /q/[id] page is a public endpoint with no authentication barrier, making it a target for automated spam submissions. Disabling bot protection on this page would compromise the integrity of the data collected by platform users. We rely on the legitimate interest legal basis for this processing under GDPR.
Sentry (Error Monitoring)
Sentry monitors for application errors and performance issues. It does not set persistent cookies. It captures session context (browser, OS, page URL) at the moment an error occurs and associates it with an anonymized user identifier. This data is used solely for debugging and is not used to build user profiles.
4.3 Analytics
These tools help us understand how the platform is used. For visitors from the EU, UK, or other regions requiring consent, these tools activate only after consent is given.
PostHog (Product Analytics)
PostHog is our primary product analytics tool. It tracks feature usage, navigation flows, and session recordings (on logged-in pages only). We use PostHog Cloud (US region, hosted at us.posthog.com).
| Name | Provider | Type | Expiry | Purpose |
|---|---|---|---|---|
ph_* (e.g. ph_posthog_distinct_id) | PostHog | Local storage + cookie | 1 year | Identifies a returning session/user anonymously |
ph_*_ses | PostHog | Session storage | Session | Tracks a single browsing session |
PostHog does not run on the /q/[id] respondent page in production configuration.
Google Analytics / Google Tag Manager
Google Tag Manager (GTM) loads Google Analytics 4 (GA4) on the marketing site (fieldread.ai home, pricing, blog, docs). GTM does not itself set analytics cookies — it manages when other scripts fire.
| Name | Provider | Type | Expiry | Purpose |
|---|---|---|---|---|
_ga | Cookie | 2 years | Distinguishes unique users in GA4 | |
_ga_H63X5W4ZYN | Cookie | 2 years | Stores session state for GA4 | |
_gid | Cookie | 24 hours | Distinguishes users over short periods |
Google Analytics does not run on the /q/[id] respondent page in production configuration.
4.4 Third-Party Functional (OAuth Login)
When you choose to sign in with a third-party provider (Google, GitHub, LinkedIn, Facebook, or Apple), that provider's authentication scripts and cookies are loaded on the login page. These are controlled entirely by the respective provider and are subject to their own privacy policies. We receive only the data described in our Privacy Policy Section 1.
5. The Respondent Page (/q/[id]) — Specific Disclosure
Because respondents visit this page without any prior relationship with Field Read, we want to be especially clear about what runs there:
| Technology | Runs on /q/[id]? | Basis |
|---|---|---|
| Session authentication cookies | No (no account required) | — |
| Google reCAPTCHA v3 | Yes | Strictly necessary / legitimate interest (bot protection) |
| Sentry error monitoring | Yes | Legitimate interest (debugging) |
| PostHog analytics | No | — |
| Google Analytics / GTM | No | — |
| Upstash rate limiting (server-side) | Yes (no cookie) | Strictly necessary |
Respondents on this page are subject to Google's reCAPTCHA processing and Sentry's error logging. No marketing analytics or session recording runs on this page.
6. Managing Your Cookie Preferences
Cookie consent banner
On your first visit to fieldread.ai (excluding the /q/[id] page), a cookie consent banner allows you to accept or decline analytics cookies. Strictly necessary and legitimate-interest cookies cannot be declined as they are required for the site to function.
You can change your preferences at any time by clicking "Cookie preferences" in the site footer.
Browser-level controls
All major browsers allow you to block or delete cookies through their settings. Note that blocking strictly necessary cookies will break authentication and may prevent you from logging in.
Opt-out links for specific providers
- Google Analytics: Google Analytics Opt-out Browser Add-on
- Google reCAPTCHA: No direct opt-out; block via browser settings or a content blocker (note: this will break response submission)
- PostHog: Email [privacy@fieldread.ai] with the subject "PostHog opt-out" and we will suppress tracking for your account
7. Changes to This Policy
We update this policy when we add, remove, or materially change the cookies or tracking tools we use. The "Last updated" date at the top of this page reflects the most recent revision. For material changes, we will notify registered platform users by email.
8. Contact
For questions about this Cookie Policy or to exercise your data rights:
Email: [privacy@fieldread.ai]
Mailing address: [Company Legal Name], [Street Address], [City, State, ZIP]