narrlitnarrlitLast updated: April 19, 2026
Cookies are small text files a website stores in your browser. Some are essential for the site to work, others help us understand how the service is used or attribute ads. narrlit splits cookies into three clear categories and asks you to choose before loading anything that is not strictly necessary.
| Cookie / storage | Purpose | Duration |
|---|---|---|
| sb-access-token | Supabase access token, keeps you signed in | 1 hour (refreshed) |
| sb-refresh-token | Supabase refresh token, renews your session | 30 days |
| narrlit-player | Remembers volume and playback speed | Local storage, until cleared |
| narrlit-consent | Stores your cookie preferences | Local storage, 6 months |
No consent is required for these, the service cannot work without them.
| Cookie | Purpose | Duration |
|---|---|---|
| _ga | Google Analytics 4 (via Tag Manager), unique visitor ID | 2 years |
| _ga_<property> | Google Analytics 4 session state | 2 years |
| ph_<project>_posthog | PostHog, distinct visitor ID, session state | 1 year |
Google Tag Manager (the container) loads only if you click Accept all or enable Analytics in the preferences modal. GTM then loads Google Analytics 4 inside it. PostHog is hosted in the EU, and the ph_<project>_posthog entry above is written only once you enable Analytics. Enabling Analytics also turns on PostHog session replay, which records how you move through pages so we can see where the product confuses people. Replays exclude the contents of input fields.
Two things measure traffic without storing anything on your device, so they need no consent and are unaffected by the choices above.
Vercel Web Analytics counts page views and shows which pages people reach. Visitors are counted server-side from a hash that is discarded daily, so it cannot follow you across sites or across days.
PostHog in cookieless moderuns from the moment a page loads, before you answer the cookie dialog. In this mode the visitor ID lives in the page's memory for as long as the tab is open and is never written to a cookie or to local storage, so it is gone when you close the tab and cannot link your visits together. Session replay is off. We rely on legitimate interest here (Art. 6(1)(f) GDPR) to see how many people reach the site and which pages work, which we cannot learn from people who never answer the dialog at all.
If you choose Reject non-essential, this stops too. We treat that click as an objection under Art. 21 GDPR and stop collecting entirely rather than continuing in cookieless mode.
When enabled, ad-attribution tags (for example Meta Pixel) loaded through Google Tag Manager may set cookies such as _fbp (3 months) to attribute ad clicks to conversions. Google Tag Manager inherits your consent state, so these tags do not fire while the Marketing category is disabled.
When you sign in with Google, Google may set its own cookies on its own domains as part of the OAuth flow. Those cookies are outside our control and are governed by Google's own privacy notices. Payment pages hosted by Lemon Squeezy may likewise set cookies on lemonsqueezy.com during checkout.
Change your choice any time from Settings → Privacy preferences. You can also clear or block cookies through your browser settings; blocking Supabase cookies will sign you out of narrlit.
See our Privacy Policy for the full picture, or email filip.djordjevic447@gmail.com.