Tracking & Analytics Notice

1. The short version

No optional analytics runs until you explicitly click "Allow analytics." This applies to every visitor — anonymous or signed in — every time, with no exceptions and no temporary window where tracking runs before you decide.

2. What EngX uses

• PostHog — behavioral analytics: page views, clicks, and feature interactions. Session recording is explicitly disabled.
• Vercel Web Analytics — page-view analytics (URL path, referrer, User-Agent).
• Vercel Speed Insights — performance analytics (Core Web Vitals: load time, layout stability, responsiveness).

All three are optional and are gated behind the same single analytics consent decision — there is no way to allow one and block another individually today.

3. Before you decide (no consent yet)

On your first visit, or any time you haven't made a choice, none of the three tools above are initialized. No events are captured, no scripts from these providers run, and no identifiers related to them are created. This is true whether you're browsing anonymously or signed in.

4. After you grant consent

Once you click "Allow analytics" (in the banner or in Settings → Privacy), all three tools initialize:

• PostHog begins capturing page views and interaction events (no session recording).
• Vercel Analytics mounts and begins sending page-view events.
• Speed Insights mounts and begins sending Core Web Vitals events.

Your consent decision is recorded before any of these initialize, not after.

5. If you decline or withdraw consent

When you decline, or later withdraw consent from Settings → Privacy:

• No further PostHog events are captured; your PostHog identity is reset and its local storage/cookie entries are cleared.
• The Vercel Analytics component is removed from the page; no further page-view events are sent.
• The Speed Insights component is removed from the page; no further performance events are sent.

Declining or withdrawing analytics consent never affects your ability to use EngX — your account, subscription, and learning progress are unaffected.

6. Storage this uses

• Your analytics preference itself: stored in localStorage under the key engx_analytics_consent, values "granted" or "denied". This is a first-party, browser-local value — it is never transmitted to our servers automatically and is not itself a tracking identifier.
• PostHog (only once you've granted consent): writes its own localStorage and cookie entries to remember your analytics session. These are cleared on withdrawal (§5).
• Vercel Analytics / Speed Insights: write no localStorage, sessionStorage, or cookies in your browser at all, under any consent state.

7. Anonymous visitors vs. signed-in users

Anonymous: your choice is remembered in localStorage only, local to that browser.

Signed in: your choice is additionally recorded in EngX's server-side consent ledger, tied to your account, so it's consistent across devices where you're signed in. If you were anonymous and had granted consent, then sign in with no existing server-side record for your account, EngX does not silently carry over the anonymous preference — you're asked again, so the recorded consent is always one you made while authenticated.

8. Session recording

PostHog session recording is disabled and is not planned to be enabled without a separate privacy review and an update to this notice.

9. How to change your choice

At any time, go to Settings → Privacy Centre → Analytics to see your current status and change it.

10. Hosting-level data (not "analytics")

Separately from the optional analytics above, our hosting provider (Vercel) necessarily processes standard web request data (such as IP address) to serve the site at all, the same as any web host. This is not gated by analytics consent because it isn't optional analytics — it's how any request reaches our servers. See our Privacy Policy §10.

11. LEGAL REVIEW REQUIRED items

• Whether the engx_analytics_consent localStorage item itself requires disclosure under applicable cookie/storage notice laws.
• Whether Vercel Analytics/Speed Insights require explicit consent in every applicable jurisdiction, or could rely on a different lawful basis.
• PostHog's server-side IP/geolocation enrichment in applicable jurisdictions.
• Cross-border data transfer mechanisms for PostHog and Vercel.