Global Privacy Control (GPC)

What we do when GPC is on

• Our middleware reads Sec-GPC: 1 and sets a session cookie gh_gpc_honored=1.
• Product analytics (PostHog) and downstream behavioral tracking no-op for the request. Every server-side analytics call keyed to your account is skipped too. Stripe + Sentry still run for service delivery and error reporting (CCPA service-provider exemption).
• What keeps running, said here rather than left to be found: cookieless aggregate counts through Vercel Web Analytics. They set no cookie and carry no account id, email, or business name, so there is no identity in them to opt out of, and suppressing them per visitor would mean tracking that visitor in order to stop counting them. A content blocker stops them at the browser, and we do not work around one.
• Every page footer renders an “Opt-Out Honored” indicator so you can verify the signal in one glance.

How to enable GPC

Native support:

• Firefox: Preferences → Privacy & Security → enable “Tell websites not to sell or share my data.”
• Brave: on by default.
• DuckDuckGo Browser: on by default.

Via extension (Chrome / Edge / Safari):

• globalprivacycontrol.org lists every up-to-date extension that injects the header.

Verifying the opt-out

1. Enable GPC in your browser settings (above).
2. Reload our home page.
3. Scroll to the footer. You should see “Global Privacy Control honored” under the legal links.
4. DevTools → Application → Cookies should show gh_gpc_honored=1.