Cookie Policy
Effective date: June 11, 2026 Last updated: June 11, 2026
This Cookie Policy explains the cookies and browser storage used on mattoxengineering.com.
1. What cookies and storage we use
We group cookies and similar browser storage into two categories.
1.1 Strictly necessary (always on)
These make the site work, protect the admin area, preserve functional preferences, and record your privacy choice. They cannot be turned off through the site controls and are not used for advertising.
This category includes the cookie that records your consent choice (me_consent), admin-area session and CSRF cookies that apply only to logged-in administrators, Cloudflare functional/edge cookies, and functional browser storage for popup suppression and chat continuity.
1.2 Analytics (opt-in only)
Analytics storage is set by our self-hosted PostHog analytics only after you opt in through the cookie banner. Before you consent, PostHog is not initialized, no PostHog cookie is set, and no analytics request is made. PostHog is served first-party through our own /ingest path rather than from a third-party analytics domain.
2. Cookie / storage table
| Name | Purpose | Category | Duration |
|---|---|---|---|
me_consent | Records your cookie consent choice and consent version | Strictly necessary | About 12 months |
__Host-me_session | Admin login session access token; admins only | Strictly necessary | Session / about 15 minutes |
__Host-me_refresh | Admin session refresh token; admins only | Strictly necessary | About 7 days |
__Host-me_csrf | CSRF token protecting admin actions; admins only | Strictly necessary | Tied to the admin session |
| Cloudflare functional cookies | CDN, WAF, edge routing, bot mitigation, and security | Strictly necessary | Per Cloudflare defaults |
me_popup_session_shown in sessionStorage | Limits lead-magnet popup frequency to once per browser session | Strictly necessary / functional | Browser session |
me_popup_suppress_<type> in localStorage | Suppresses a dismissed or submitted popup for the relevant magnet | Strictly necessary / functional | 7 days |
me_chat_visitor in localStorage | Maintains a pseudonymous chat visitor id so the chat can continue across pages | Strictly necessary / functional | Until cleared by the browser or user |
ph_<project_api_key>_posthog | PostHog pseudonymous analytics state such as distinct ID, session ID, device ID, feature-flag state, configured super properties, and SDK configuration state | Analytics (opt-in) | 365 days unless analytics is rejected or revoked sooner |
PostHog project storage in localStorage | PostHog analytics state used with the cookie above | Analytics (opt-in) | No fixed browser expiration; cleared when analytics is rejected or revoked |
Cookie names use the __Host- prefix where shown, which means host-only, HTTPS-only cookies without a Domain attribute. The admin cookies only appear for people who log into the admin console. Ordinary visitors do not receive admin cookies.
3. Functional storage that is not analytics
Some site features use browser storage for functionality rather than analytics. Popup frequency controls prevent repeated popups during the same session and suppress dismissed popups for 7 days. The chat widget stores a pseudonymous visitor id so the chat experience can continue as you browse.
These functional items work regardless of your analytics choice. If you reject analytics, you can still see popups, use chat, and submit forms. Only analytics events about those actions are suppressed. This functional storage is not used for advertising.
4. How to control cookies
When you first visit, a consent banner appears. It offers controls to accept analytics, reject analytics, or open preferences. Strictly necessary cookies cannot be toggled off through the site controls.
You can change or withdraw your choice at any time using the "Cookie settings" link in the site footer. If you turn analytics off after having it on, we stop capturing analytics and clear the PostHog analytics cookies and storage.
We will ask you to choose again if your consent cookie expires or if we make a material change to our cookies, such as adding a new category.
We do not run advertising or marketing-tracking cookies. If that ever changes, it will be handled as a separate consent category.
5. More information
For who we are, how long we keep data, your rights, and our processors, see the Privacy Policy. Questions: privacy@mattoxengineering.com or hello@mattoxengineering.com.