Cookies

Last updated: July 2026

Your JP Adventure uses three kinds of cookies. The first kind - strictly-necessary cookies - are required to sign you in and protect your account. Under UK GDPR and the ePrivacy Regulations, we don't need prior consent to set them.

The second kind - analytics cookies (Google Analytics 4 and, where used, PostHog) - only fire if you accept analytics in the cookie banner. They record aggregated page-view counts and feature usage so we can see what people read and use.

The third kind - marketing cookies (Google AdSense for contextual ads, Google Ads, Meta Ads, and TikTok Ads pixels when we run paid campaigns) - only fire if you accept marketing cookies. They serve ads, frequency-cap them, and measure aggregate conversions from our ad campaigns. You can reject any or all of these in the banner, change your mind via Cookie preferences in the footer, or clear cookies in your browser.

We do not use:

Social media embeds that set cookies before consent
Tracking pixels that fire before you opt in
Cookies that share personally identifiable information with advertisers

The cookies we set

next-auth.session-token (or __Secure-next-auth.session-token)
Keeps you signed in. NextAuth’s session cookie; without it you would have to re-authenticate on every request.
Lifetime
Session (cleared when you sign out or close the browser)
Type
Strictly necessary
Set by
NextAuth
next-auth.csrf-token
Cross-site request forgery protection on the sign-in form. Required for OAuth and magic-link flows.
Lifetime
Session
Type
Strictly necessary
Set by
NextAuth
next-auth.callback-url
Remembers where you were trying to go before sign-in so we can redirect you back.
Lifetime
Session
Type
Strictly necessary
Set by
NextAuth
__yjpa_2fa
Marks your session as having passed two-factor authentication. Only set after you successfully enter your OTP code on /verify-2fa. Without two-factor enabled on your account, this cookie is never set.
Lifetime
24 hours
Type
Strictly necessary
Set by
Your JP Adventure
sb-* (multiple)
Supabase auth helpers. Bridge between NextAuth and the Supabase database client so server-side data fetches are scoped to your account.
Lifetime
Session
Type
Strictly necessary
Set by
Supabase
yjpa_cookie_consent_v1 (localStorage, not a cookie)
Records your cookie-banner choices so the banner doesn’t reappear every visit. Stored in your browser’s localStorage, not transmitted to us.
Lifetime
Until you clear browser data
Type
Functional
Set by
Your JP Adventure
_ga, _ga_*Opt-in
Google Analytics 4 - distinguishes unique sessions and records aggregated page-view counts. No personal data is shared with us.
Lifetime
Up to 13 months
Type
Analytics
Set by
Google Analytics
ph_* / posthog (when enabled)Opt-in
PostHog product analytics - funnels and feature-usage tracking. Loaded only after you accept analytics cookies.
Lifetime
Up to 12 months
Type
Analytics
Set by
PostHog
__gads, __gpi, IDE, ANID, etc.Opt-in
Google AdSense - serves contextual ads, measures ad performance, and applies frequency capping. Loaded only after you accept marketing cookies.
Lifetime
Up to 24 months
Type
Marketing
Set by
Google AdSense
_gcl_au, _gcl_aw (when ads campaigns run)Opt-in
Google Ads - measures whether visitors from our ad campaigns reach key conversion pages. Reports aggregate counts to us. Loaded only after you accept marketing cookies.
Lifetime
Up to 90 days
Type
Marketing
Set by
Google Ads
_fbp, fr (when Meta campaigns run)Opt-in
Meta (Facebook/Instagram) Ads pixel - measures aggregate ad-driven conversions for any paid campaigns we run on Meta. Loaded only after you accept marketing cookies.
Lifetime
Up to 90 days
Type
Marketing
Set by
Meta
_ttp, tt_appInfo, tt_pixel_session_index (when TikTok campaigns run)Opt-in
TikTok Ads pixel - measures aggregate ad-driven conversions for any paid campaigns we run on TikTok. Loaded only after you accept marketing cookies.
Lifetime
Up to 13 months
Type
Marketing
Set by
TikTok

Name	Purpose	Lifetime	Type	Set by
next-auth.session-token (or __Secure-next-auth.session-token)	Keeps you signed in. NextAuth’s session cookie; without it you would have to re-authenticate on every request.	Session (cleared when you sign out or close the browser)	Strictly necessary	NextAuth
next-auth.csrf-token	Cross-site request forgery protection on the sign-in form. Required for OAuth and magic-link flows.	Session	Strictly necessary	NextAuth
next-auth.callback-url	Remembers where you were trying to go before sign-in so we can redirect you back.	Session	Strictly necessary	NextAuth
__yjpa_2fa	Marks your session as having passed two-factor authentication. Only set after you successfully enter your OTP code on /verify-2fa. Without two-factor enabled on your account, this cookie is never set.	24 hours	Strictly necessary	Your JP Adventure
sb-* (multiple)	Supabase auth helpers. Bridge between NextAuth and the Supabase database client so server-side data fetches are scoped to your account.	Session	Strictly necessary	Supabase
yjpa_cookie_consent_v1 (localStorage, not a cookie)	Records your cookie-banner choices so the banner doesn’t reappear every visit. Stored in your browser’s localStorage, not transmitted to us.	Until you clear browser data	Functional	Your JP Adventure
_ga, _ga_*Opt-in	Google Analytics 4 - distinguishes unique sessions and records aggregated page-view counts. No personal data is shared with us.	Up to 13 months	Analytics	Google Analytics
ph_* / posthog (when enabled)Opt-in	PostHog product analytics - funnels and feature-usage tracking. Loaded only after you accept analytics cookies.	Up to 12 months	Analytics	PostHog
__gads, __gpi, IDE, ANID, etc.Opt-in	Google AdSense - serves contextual ads, measures ad performance, and applies frequency capping. Loaded only after you accept marketing cookies.	Up to 24 months	Marketing	Google AdSense
_gcl_au, _gcl_aw (when ads campaigns run)Opt-in	Google Ads - measures whether visitors from our ad campaigns reach key conversion pages. Reports aggregate counts to us. Loaded only after you accept marketing cookies.	Up to 90 days	Marketing	Google Ads
_fbp, fr (when Meta campaigns run)Opt-in	Meta (Facebook/Instagram) Ads pixel - measures aggregate ad-driven conversions for any paid campaigns we run on Meta. Loaded only after you accept marketing cookies.	Up to 90 days	Marketing	Meta
_ttp, tt_appInfo, tt_pixel_session_index (when TikTok campaigns run)Opt-in	TikTok Ads pixel - measures aggregate ad-driven conversions for any paid campaigns we run on TikTok. Loaded only after you accept marketing cookies.	Up to 13 months	Marketing	TikTok

Managing cookies

You can clear cookies in your browser settings at any time. The site will still work - you'll just need to sign in again. To prevent cookies entirely, most browsers offer a private browsing mode.

Questions

See our privacy policy for the full picture of what data we collect, or use the contact page to get in touch.