Cookie and Tracking Notice

Effective Date: September 27, 2026 · Version: 1.1

Audience: public (anyone visiting Hubabble or using its services, including coaches, their clients, and general visitors).

1. About this notice

This notice explains how Hubabble, LLC ("Hubabble," "we," "us," or "our") uses cookies, similar technologies, and lightweight telemetry on our websites and in our product. It is meant to be read alongside our Privacy Policy, which explains the broader picture of how we handle personal information.

Hubabble, LLC is a member-managed multi-member limited liability company organized under Oregon law.

Our keep-it-simple promise: today Hubabble runs on a small, essential set of cookies, one lightweight performance-telemetry tool, and, only inside the signed-in dashboard, one analytics and error-tracking tool that keeps nothing on your device. We do not use advertising cookies or marketing pixels, and we do not build advertising profiles. We do not sell your information, and we do not let anyone use it to follow you around the web.

2. What cookies and similar technologies are

A cookie is a small text file a website stores on your device so it can remember things between page loads. "Similar technologies" include local storage, session storage, and small pieces of code that load when a page renders and report back basic information (for example, how quickly the page loaded). In this notice, when we say "cookies," we mean cookies and these similar technologies together unless we say otherwise.

We group what we use into two buckets:

• Essential. Needed for the site and product to work at all. Without these you could not sign in, stay signed in, submit a form securely, or have the product remember basic choices. Essential cookies do not require consent under most laws because the service cannot function without them.
• Non-essential. Everything else (analytics that is not strictly necessary, advertising, behavioral tracking). We use no advertising tracking and no tracking across other websites. The one non-essential tool we run is PostHog, for analytics and error tracking inside the signed-in dashboard only, and it keeps nothing on your device. The one performance tool we run is described in Section 4, and Section 6 explains why we treat it as essential and why PostHog needs no consent banner.

3. What we use today

Today Hubabble uses only:

1. Essential and authentication cookies that keep you signed in, protect forms and requests from cross-site attacks, and remember basic, non-tracking preferences.
2. Vercel Speed Insights, a lightweight performance-telemetry tool from our hosting provider that measures how fast pages load and render.
3. PostHog, inside the signed-in dashboard only (the app coaches and Community members use after signing in), for product analytics, session replay, and error tracking. It sets no cookies and keeps nothing in your browser's local or session storage. Its session replays show the app itself but hide everything typed into forms, people's names, email addresses, phone numbers, and what members post, and your clients' information is never sent to it. It never loads on our marketing site, on coaches' websites, or on the links coaches send their clients.

That is the whole list. We do not use:

• Advertising or marketing cookies or pixels.
• Analytics on our marketing site, on coaches' websites, or on the links coaches send their clients.
• Social media tracking widgets.
• Third-party cross-site trackers of any kind.

4. Cookie and tracking table

The table below lists what Hubabble sets or loads today, what it is for, who sets it, roughly how long it lasts, and whether it is essential. Exact cookie names, domains, and lifetimes are implementation details that may change over time.

5. Why our footprint is this small (and honest)

Hubabble is deliberately built to collect as little as possible. We use a single performance tool from our existing hosting provider, and our one analytics tool, PostHog, runs only inside the signed-in dashboard, keeps nothing on your device, and masks people and what members post. This keeps the cookie picture simple and keeps us from claiming consent or tracking we do not actually do.

We would rather under-promise here than over-claim. If that changes, Section 7 explains what we will do before turning anything new on.

6. Consent: where things stand today

Most laws treat essential cookies (Section 4, rows marked "Yes") as not requiring opt-in consent, because the service cannot function without them. We rely on that basis for those cookies.

Two items are worth explaining. The first is Vercel Speed Insights. Under the EU ePrivacy Directive and UK PECR, storing or reading information on a user's device generally requires consent unless it is strictly necessary to provide the service the user asked for. Pure performance measurement is sometimes treated as strictly necessary and sometimes not, depending on how it is implemented and which regulator you ask.

We have not built a cookie consent banner, and at our current footprint we do not believe one is required. Vercel Speed Insights is cookieless and aggregated: it sets no cookie or persistent identifier, stores nothing on your device, and reads nothing stored on it, so the consent rule for storing or reading information on a device does not apply to it. That also supports treating it as strictly necessary performance measurement. The second is PostHog in the signed-in dashboard. We set it up so that it keeps nothing on your device: it sets no cookies, keeps nothing in local or session storage, holds what it needs in memory, and forgets it when the page is closed or reloaded. It is not entirely hands-off, so here is exactly what it does: when its script starts, it checks whether your browser's storage works (by writing a test value and removing it at once) and looks there for a few of its own settings, such as an opt-out or a debug switch, and it reads the page's cookies once while doing so. We never put anything there for it to find, and we have switched off its settings that a specially crafted link could turn on to store something, so those checks find nothing and leave nothing behind. It runs only for people signed in to their own Hubabble account, never on our marketing site, on coaches' websites, or on the links coaches send their clients. Its replays mask everything typed into forms, people's names, email addresses, phone numbers, and what members post (the app's own words, and the names you give things like session types and spaces, still show), it blocks images, video, and embedded frames, never records some pages at all, and never receives your clients' information. For those reasons we do not show a consent banner for it. If we change how either tool is set up so that it keeps anything on your device or reads back anything kept there, or add any other non-essential analytics, we will reassess and add a banner or consent step before doing so, as described in Section 7.

7. If we add more tracking later (consent banner trigger)

A cookie consent banner, and the related opt-out and preference machinery, becomes required if we add non-essential technologies that keep information on your device or read back information kept there, or advertising technologies. Concretely, before we turn on any analytics that keeps information on your device or reads back information kept there, any analytics outside the signed-in dashboard (on our marketing site, on coaches' websites, or on the links coaches send their clients), marketing pixels, retargeting, or any cross-site tracking or tracking for advertising, we will:

1. Update this notice and the Privacy Policy, with a new Effective Date and Version, to list exactly what is being added and why.
2. Implement a consent mechanism appropriate to the applicable jurisdictions. For the EU/UK this means prior, informed, opt-in consent before non-essential cookies are set, with an equally easy way to decline and to change your mind later. (We would build the consent banner and the controls that withhold non-essential scripts as part of that work; they are not needed today because the one non-essential tool we run keeps nothing on your device.)
3. Assess US state-law obligations. Several US state privacy laws (for example California's CCPA/CPRA) treat certain uses of tracking technologies as a "sale" or "sharing" of personal information for cross-context behavioral advertising, which triggers a "Do Not Sell or Share My Personal Information" right and an opt-out signal (including Global Privacy Control) obligation. If we ever add such technology, we would add the required opt-out link, honor Global Privacy Control, and make the related disclosures. None of this is required at our current footprint, because we do not use advertising or cross-context tracking.

To be clear: today none of this applies. The one non-essential tool we run, PostHog, keeps nothing on your device and runs only in the signed-in dashboard (Section 6), and we run no cross-site tracking or tracking for advertising. This section describes the trigger and the commitment, not a current practice.

8. How telemetry relates to your data and our role

This notice covers cookies and on-device technologies specifically. Our broader data practices, including the roles we play, are in the Privacy Policy. In short:

Hubabble is the controller of coach, account, and visitor data, including the limited performance telemetry described here. For a coach's client data, the coach is the controller and Hubabble is the processor. Clients interact with Hubabble surfaces directly through tokenized links on the coach's behalf.

Our payment provider, Stripe, plays a dual role: Stripe acts as a subprocessor when it processes payments on the coach's behalf, and as an independent controller for its own fraud-prevention and legal-compliance purposes. We state this the same way everywhere it appears.

The Vercel Speed Insights telemetry described here is processed by Vercel as a subprocessor that hosts and serves Hubabble. The dashboard analytics, session replay, and error tracking described here are processed by PostHog as our subprocessor; it never receives your clients' personal data. The single canonical list of subprocessors is the Subprocessor List (subprocessor-list.md); the Privacy Policy and the DPA reference it, and any inline summary (including the one below) must match its live, imminent, and future split. For convenience, the current subprocessors include: Neon (database of record), Vercel (hosting, edge, and Speed Insights telemetry), Stripe (platform billing, with client payments to follow), Google (per-coach calendar features), Resend (transactional and document email; our email provider can record delivery and engagement events such as opens and clicks where that is enabled), AWS S3 in AWS region us-east-1 (US East, N. Virginia) (storage of signed documents), Inngest (background jobs), Cloudflare (DNS and inbound email), and PostHog (feature flags, error tracking, product analytics, and session replay in the signed-in dashboard). The white-labeled video provider also acts as a subprocessor; it is intentionally not named on coach- or client-facing surfaces. The Subprocessor List is authoritative; if anything here diverges from it, the Subprocessor List controls.

Note on email tracking: for emails Hubabble sends through Resend (such as confirmations and document/e-sign notifications), our email provider can record delivery and engagement events such as opens and clicks where that is enabled. The send path does not turn tracking on by default. That is message-level tracking inside email, not website cookies, so it is governed by the Privacy Policy and your email client rather than this cookie notice. We flag it here only so the two documents do not appear to contradict each other.

9. Managing cookies in your browser

You can control cookies through your browser settings: you can see what is stored, delete cookies, and block or limit them. Most browsers also offer a "do not track" setting and, increasingly, a Global Privacy Control signal. Today we do not sell or share your information or track you across sites, which is what those signals are designed to stop, so there is nothing for them to opt you out of. If we add such tracking in the future, Section 7 governs how we will honor those signals.

If you block or delete essential cookies, parts of Hubabble (such as signing in or submitting a secure form) may not work.

10. Changes to this notice

We will update this notice when our use of cookies or telemetry changes, and always before we add any non-essential analytics or advertising technology. Material changes will be reflected in the Effective Date and Version at the top, and we will tell you in-product or by email.

11. Contact

Questions about this notice or about cookies and tracking can be sent to:

Hubabble, LLC Attn: Privacy 403 Portway Avenue, Suite 300 Hood River, Oregon 97031 Email: privacy@hubabble.com