Cookie Policy
Last updated: September 2026
This is a translation. The French text is the only legally binding version of this document. Where this English translation and the French original differ, the French original prevails.
What is a cookie?
A cookie is a small text file placed on your device (computer, tablet, smartphone) when you visit the SpineOS platform at www.spinestudio.dev. Cookies make it possible to store information about your browsing and to recognise you on subsequent visits.
In accordance with French regulations (the Data Protection Act) and with the recommendations of the CNIL, we inform you of the use of cookies on our platform and give you the option of accepting or refusing them.
Cookies used
1. Strictly necessary cookies
These cookies are essential to the operation of the platform and cannot be disabled. They do not require your consent.
| Cookie | Purpose | Duration |
|---|---|---|
| __Secure-authjs.session-token | Authentication and user session | Session / 30 days |
| __Host-authjs.csrf-token | Protection against CSRF attacks | Session |
| __Secure-authjs.callback-url | Redirection after authentication | Session |
| NEXT_LOCALE | Language preference (FR/EN) | Session on the public pages; 1 year on the application pages (sign-in, sign-up, signed-in area) |
| spineos_cookie_consent | Stores the choice you make in the banner, so that we do not have to ask you again on every page | 6 months |
One point deserves spelling out about spineos_cookie_consent: it is placed whatever your answer is, including when you refuse. Its only job is to keep a record of that choice — it is what proves you were asked and what stops the banner coming back. It contains no visitor identifier, no address and no browsing data: only a version number, "accepted" or "refused", and the date of your choice.
2. Audience-measurement and session-recording cookies (PostHog)
We use PostHog to understand how the platform is used and to detect errors. These cookies, and the service itself, are subject to your consent.
Nothing is loaded until you have accepted. Until you answer, and if you refuse, the PostHog script is not executed: no cookie is placed, nothing is stored on your device, and no request is sent to PostHog's servers — not even to download the script itself. This is not an active service put to sleep: it is not started.
| Cookie | Purpose | Duration |
|---|---|---|
| ph_phc_* | Unique PostHog identifier, which links the pages of one visit and your successive visits | 1 year |
PostHog allows us to understand how users interact with the platform (pages visited, features used, navigation paths) and to record sessions, that is, a replay of your browsing. In those recordings, the text displayed on screen and the contents of form fields are masked by default.
This data is not anonymous. When you are signed in, your account identifier and your email address are associated with these measurements: they allow us to trace them back to you where necessary. It is not sold, nor shared with third parties for advertising purposes.
PostHog is hosted in the European Union (EU Cloud).
3. What is not a cookie, but still concerns you
When you refuse audience measurement, we keep that refusal in your browser's local storage (__ph_opt_in_out_*) rather than in a cookie. That is what guarantees a refusal adds nothing to your device beyond what is strictly necessary. The entry is removed if you clear your browser's site data.
If you visited the platform before this banner existed, a PostHog cookie may have been placed on your device. From your first visit after it was introduced, that cookie and the associated browser data are deleted unless and until you accept audience measurement.
Managing your preferences
Refusing is as easy as accepting. The banner shown on your first visit offers "Accept all", "Refuse all" and "Customize", one click each, on the same screen.
You may revisit your choice at any time:
- From the platform: the "Cookie preferences" link, in the site footer and on this page, reopens the settings dialog. It shows the state actually in force, and you can withdraw a consent already given there. A withdrawal takes effect immediately, without reloading the page, and deletes the PostHog cookie already placed.
- Browser settings: You can configure your browser to accept or refuse cookies, or to alert you when a cookie is placed.
- Deleting cookies: You can delete the cookies already placed on your device through your browser settings. If you delete
spineos_cookie_consent, we no longer have a record of your choice and the banner will ask you again.
Absent any action on your part, your choice is kept for six months. After that we ask again. We also ask again if we add a new category of trackers: a choice expressed about the previous categories cannot stand for a category that did not exist.
Disabling strictly necessary cookies may affect the operation of the platform and prevent access to certain features.
Links to the cookie settings of the main browsers:
Find out more
To find out more about cookies and your rights, you can consult the CNIL website: www.cnil.fr.
Contact
For any question relating to our use of cookies:
- Email: contact@spinestudio.dev
- Post: to the postal address given in the legal notice