Essential cookies
Required for the site to function—such as security, load balancing, remembering cookie preferences, and first-party measurement of restaurant-owner visits so we can operate the marketing funnel and exclude bots and tests.
Authentication cookies
When you sign in, we use cookies to maintain your session and protect your account.
First-party measurement cookies
Unsaid sets same-origin cookies to understand how restaurant owners arrive and convert. These cookies store pseudonymous identifiers and campaign parameters only — never email addresses, names, or form values.
unsaid.vid— visitor id, kept up to 13 monthsunsaid.sid— session id, expires after 30 minutes of inactivityunsaid.lp— landing path for the current sessionunsaid.acq— campaign source/medium/campaign/content for 30 days (no email)unsaid.ft— first-touch campaign parameters, kept up to 13 monthsunsaid.sa— session-level campaign parameters, expires with the sessionunsaid.meta— Meta campaign, ad set, and ad identifiers when present on the landing URL, expires with the session. Not inferred from UTM names.
Events are stored in Unsaid's own database for 13 months, then deleted. Public directory browsing and guest feedback sessions are not mixed into owner acquisition metrics. Test traffic tagged with unsaid_test=1 is stored separately and excluded from primary reports.
Analytics cookies
Third-party product analytics (PostHog) is optional and only loads when NEXT_PUBLIC_POSTHOG_KEY is configured and marketing cookies are allowed (Global Privacy Control and Reject Optional keep it off). PostHog is used for product usage measurement, not advertising. Session recording is not enabled. Error monitoring tools may also run in the browser when configured. You can clear cookies and site data anytime in your browser settings. Essential session cookies for sign-in are always required for authenticated features.
Marketing cookies (Meta)
Optional Meta advertising measurement uses the Unsaid Website pixel only — never Rally's pixel. Browser Pixel and Conversions API follow the same privacy decision (server events do not bypass browser restrictions). Where prior consent is required — including EEA, UK, Switzerland, and when location cannot be determined — we show a prompt before Meta loads. Where an opt-out model is used, Meta may run unless you opt out via Privacy Choices, Reject Optional below, or Global Privacy Control (GPC). GPC and other applicable opt-outs take precedence over a stored marketing preference while those signals apply. Choosing Accept Marketing allows PageView, CompleteRegistration (after successful account creation), and StartTrial (only after the 30-day product trial activates). First-party measurement cookies are described above and are subject to a separate privacy classification review.
Preference cookies
Remember choices such as cookie consent so we do not ask repeatedly.
Third-party services
Some features may rely on third-party providers that set their own cookies. Their use is governed by their respective policies.
Privacy Choices / cookie controls
Change your marketing preference anytime. We remember it in unsaid.consent so we do not re-prompt. Opt-in banners appear only where prior consent is required and no preference is stored. Preference applies across /try, signup, and /org for both browser Meta Pixel and server Conversions API. You can also clear cookies in your browser settings.
Current preference: Not set
Browser settings
Most browsers let you block or delete cookies. Blocking essential cookies may affect site functionality.
Policy updates
We may update this policy from time to time. The effective date at the top will change when we do.
Contact
Questions about cookies: privacy@getunsaid.co.