Cookie & Tracking Notice

Essential storage

Essential storage is not controlled by the Allow/Decline choice because it is necessary to provide sign-in, security, consent memory, and core application functions. You can block or clear storage through your browser, but doing so may prevent sign-in or other parts of the Service from working correctly.

Technologies we use

Cookies and similar technologies, as they apply to us:

• Cookies and browser storage. Essential storage keeps sign-in, your consent choice and your payoff plan working. Only if you choose Allow, PostHog stores an analytics identifier in a cookie and in browser storage, and we store the campaign records described below.
• Scripts. PostHog's analytics script runs on the pages listed under Analytics, whatever you choose; without Allow it keeps its random id in memory only.
• Pixels and tags. We use no advertising pixels, tags or web beacons: no TikTok Pixel, no Meta Pixel and no other advertiser's code runs on our site.
• Server-to-server reports. Only with Allow, our server tells TikTok, through TikTok's Events API, when an account is created or a free trial starts, as described below.

Analytics

We use PostHog to count visits and see which pages and referral sources are used. It runs on our public marketing and calculator pages, on onboarding, and inside the app. It does not run on this notice, the Privacy Policy, the Terms, or the sign-in callback page.

What it records: the page's host and path (never its query string), the referring website's domain (never the full address of someone else's page), campaign tags from the link you followed — only values we registered ourselves; any other value is recorded as "other" — and standard browser details such as browser, operating system, device type, screen size, language and time zone. It never records your email address, which account is yours, or anything from your plan — no creditor names, balances, APRs, payments or projections.

Sign-up steps, only if you choose Allow. With Allow in effect, PostHog also records these steps of getting started: once on this device, that your payoff plan was shown and that the "Your plan is ready" prompt was shown, dismissed, or continued; each time a sign-in is started (a code is sent, or Google is chosen); and each time a sign-in completes — recorded either as a newly created account or as a returning sign-in. These steps carry the same page and browser details as above and, if you arrived from one of our registered campaign links, that campaign's name (source, medium and campaign), so the campaign stays with your visit across pages. They never carry your email address, your name, which account is yours, payment details or anything from your plan. If you have not chosen, choose Decline, or your browser sends a Global Privacy Control signal, none of these steps is recorded.

What we store on your device for them (only with Allow): dang.funnel.v1, in browser storage, so a step is not counted again on every reload: which of the once-only steps above this browser has already recorded and when, the time of the last sign-in it recorded, and a short code derived from the internal ID of any account whose creation it recorded (never your email address, and never sent to PostHog or anyone else). It has no expiry date of its own: it stays until you choose Decline in Cookie settings, your browser starts sending a Global Privacy Control signal, or you clear your browser storage. If you choose Decline, we delete it at once, on whichever of our pages you are on. If your browser starts sending a Global Privacy Control signal, we delete it the next time you open our home page, a calculator, onboarding or the app — before anything else can be recorded.

If you Allow, PostHog stores an identifier on your device, in a cookie and in browser storage, so repeat visits can be recognised. If you decline, or your browser sends a Global Privacy Control signal, we keep counting visits without an ID and store no PostHog identifier on your device: a random id is held in memory for the page you are reading and is discarded when that page closes. That means a returning visitor is counted again each time, so these counts sit above the number of people and at or below the number of page views.

We keep the browser analytics identifier until you decline analytics, clear your browser data, or the browser removes it. Analytics events are stored by our analytics provider, PostHog, for at least one year on our current plan; PostHog doesn't commit to deleting them after that.

Optional: advertising measurement (TikTok)

With your permission, our server may tell TikTok (TikTok for Business) when an account is created or a free trial starts, so we can know whether our TikTok ads lead to sign-ups and free trials.

• Only if you choose Allow. Nothing is reported if you choose Decline or have not chosen yet, and never while your browser sends a Global Privacy Control signal.
• No TikTok code on our site. We do not use TikTok Pixel. No TikTok script runs on any of our pages or in the app, and our site sets no TikTok cookies.
• What our server reports: through TikTok's Events API, that an account was created ("CompleteRegistration") or that a free trial started ("StartTrial"). Our site asks our server to report a new account only from the browser you signed up in, only if you had chosen Allow there before your account was confirmed (as timed by that browser's clock) and Allow is still in effect when it asks, and only within 24 hours of your email being confirmed; it asks to report a free trial only from a browser with Allow in effect when you return from checkout, within 48 hours of the trial starting. Each is reported at most once — once per account and once per subscription — however many browsers or devices you use. Each report contains only: the event's name; the time it was sent; a random event number (so TikTok can recognise a duplicate); TikTok's click identifier ("ttclid"), only if one is stored on that device (see Campaign attribution); and a fixed page address, https://dangpayoff.com/app.html — never your IP address, your browser's details, the address of the page you were on, the referring page, a query string or a fragment. We send TikTok no email address, phone number, name, plan data (debts, balances, APRs, payments), account or payment identifiers, prices or plan details, and no hashed identifiers (we do not use TikTok's Advanced Matching). A report already sent is not recalled if you later choose Decline. TikTok handles what it receives under its own privacy policy.
• What we store on your device (only with Allow): if you arrived from one of our registered TikTok ad links, the campaign's name (source, medium and campaign — only values we defined ourselves, never the link itself) and, if the link carried one, TikTok's click identifier ("ttclid", only if it consists of letters, digits, dots, dashes and underscores), in browser storage (dang.acq.v1) for up to 30 days; dang.tt.reg.v1 (an account created on this device whose report is waiting for our server's decision); and dang.tt.sent.v1 (a note that this device already asked our server about your free trial). Whether a report is made is decided by our server, at most once per account and once per subscription. We keep those decisions ourselves: the "CompleteRegistration" record on our servers (your account's ID and the time; deleted when your account is deleted), and the "StartTrial" note on your customer record at our payment provider, Stripe.
• Saved with your account: if you then create an account, the campaign tag (not the click identifier) is saved with your account so we can count how many sign-ups and trials came from each campaign. If you decline, or your browser sends a Global Privacy Control signal, nothing is stored on your device for TikTok and nothing is saved to your account.
• Older TikTok cookies: earlier versions of our site could set TikTok cookies (_ttp, ttcsid, ttcsid_<pixel id> and _tt_enable_cookie) and tt_ session-storage entries. Whenever you open any of our pages, whatever your choice, we delete them from our domain. TikTok may also use its own cookies on tiktok.com, which our site cannot read or delete.
• When this notice adds new tracking, we publish a new notice version: if you had chosen Allow, we ask you again before anything new applies, and a Decline stays in place.

Your choice, your device

Choose Allow or Decline in the banner, and change your mind anytime via "Your Privacy Choices" in the site footer, or "Cookie settings" in the app under Account → Privacy & data. Your choice is saved on this device. Declining never limits the product.

Global Privacy Control

Global Privacy Control. If your browser sends a Global Privacy Control (GPC) signal, we treat it as an opt-out of the sale or sharing of personal information and targeted advertising. We do not use advertising trackers or persistent analytics identifiers on your device. We may continue limited cookieless audience measurement to count visits and understand which pages and referral sources are used. Cookieless measurement does not store PostHog identifiers in cookies, local storage, or session storage on your device and is not used for targeted advertising.

Withdrawal

If you decline analytics cookies, we do not use persistent or identified analytics. We may continue limited cookieless audience measurement to count visits and understand site usage without storing PostHog identifiers on your device.

If you change your choice to Decline in Cookie settings, we delete from that device, at once, the stored campaign tag, TikTok click identifier, TikTok event records and the sign-up step record (dang.funnel.v1); the sign-up steps stop being recorded, and that browser stops asking our server to report anything to TikTok. A report already sent is not recalled. This does not remove a campaign tag already saved with your account; to have that removed, email privacy@dangpayoff.com.