Essential storage
Cutwords uses first-party browser storage for sign-in state, security and interface preferences, upload continuity, and your analytics choice. These functions are needed to provide the service and are not used to build advertising profiles.
A random consent identifier records the notice and choices shown without requiring an account. Signed-in choices may be linked to the internal account ID so they remain enforceable across sessions.
Product analytics
If enabled, PostHog stores a random analytics identity and session state and receives normalized page, funnel, feature, click, and scroll events. URLs are converted to route templates, campaign parameters are allowlisted, and user-entered content and sensitive attributes are excluded.
Clickmaps and scrollmaps help identify discoverability and usability problems. They show interaction patterns, not the text, media, transcripts, prompts, comments, credentials, or payment details inside a project.
Privacy-masked replay
Replay is a separate optional control and is off by default. When enabled, it is limited by route rules: account, billing, security, editor, player, UGC, repurpose, review, contract, and admin surfaces are blocked. Inputs and page text are masked, while video, audio, canvas, editable content, and private-marked elements are blocked.
Reliability diagnostics
Sentry receives privacy-scrubbed error and performance diagnostics so Cutwords can detect broken releases, API failures, and worker errors. Sentry Session Replay is disabled. Diagnostic events exclude request bodies, authorization headers, cookies, form values, user-authored content, media URLs, and payment details.
Controls and retention
Use Analytics preferences from Account settings to accept, reject, or change product analytics, replay, and project-data improvement independently. Withdrawal stops future optional browser capture immediately and removes PostHog browser persistence. Global Privacy Control forces optional analytics off under the configured policy.
Provisional retention limits are 30 days for replay, 90 days for heatmap coordinates and Sentry events, 15 months for raw product events, and 25 months for modeled aggregates. These limits may be shortened for volume, security, or legal requirements.
Contact
Questions about browser storage or analytics choices can be sent to privacy@cutwords.com.