Skip to main content
Lopperly

Cookie Policy

Last Updated: September 5, 2026

This Cookie Policy explains how Lopperly LLC ("Lopperly," "we," "our," or "us") uses cookies, browser storage, and similar technologies on the Lopperly platform. For broader information about how we handle your personal data, see our Privacy Policy.

1. What Are Cookies?

Cookies are small text files placed on your device by a website when you visit it. They allow the website to remember your actions and preferences over a period of time so you don't have to re-enter them each time you visit. Cookies can be:

  • Session cookies: temporary; deleted when you close your browser
  • Persistent cookies: stored on your device for a set period or until you delete them
  • First-party cookies: set by Lopperly
  • Third-party cookies: set by external services we use

Some of the things listed below are not cookies but work the same way from your point of view: localStorage and sessionStorage are places a site can keep small pieces of data in your browser. We include them here, because leaving them out would give you an incomplete picture.

2. Cookies and Storage We Use

2.1 Cookies We Set Ourselves

These are set by Lopperly, not by an outside company. Without the first one you cannot stay signed in.

| Cookie | Purpose | Duration | |--------|---------|----------| | lopperly_token | Keeps you signed in. Holds your login token and is not readable by page scripts. | 14 days | | lopperly_last_email | Remembers the email address you last signed in with, so the sign-in page can fill it in for you. It deliberately outlives sign-out; "use a different email" clears it. | 1 year | | NEXT_LOCALE | Remembers the language you are reading the site in. | 1 year | | redirect_to | Remembers the page you were on when you were asked to sign in, so we can send you back to it. | 10 minutes | | impersonation_notice | Set while a Lopperly support session is viewing your account, so the banner telling you that stays on screen. | 15 minutes |

We also use sessionStorage to remember the page to return you to after signing in, and localStorage to keep a draft of the "suggest a place" form so you don't lose what you typed. Both stay in your browser and are not sent to us as cookies.

2.2 Product Analytics and Session Replay — PostHog

We use PostHog to see how the Platform is actually used: which pages are viewed, and which steps of a flow like creating a listing or placing an order people finish or drop out of. We use this to find what is broken or confusing.

PostHog is served through our own domain (lopperly.com/ingest), which is why its cookie is a first-party one. Your browser does not send analytics to PostHog itself — it sends them to us, and our server passes them on without attaching your IP address.

PostHog keeps two records in your browser under the same name. They do not hold the same thing: the browser storage is the full picture, and the cookie is a smaller extract of it that our server can read on a request.

| Cookie / storage | Purpose | Duration | |--------|---------|----------| | ph_…_posthog cookie | The identifiers PostHog uses to recognise your browser and tie a sequence of pages into one visit, plus how you first arrived at the site (the referring page and the address you landed on) | 1 year | | ph_…_posthog browser storage | Everything PostHog keeps for your browser, in localStorage. It contains the cookie's contents and more besides — which features are switched on for you, and properties carried from one event to the next | Until it is cleared |

Signing out erases both, and PostHog starts again with a fresh anonymous identifier — so the next person to use a shared browser does not inherit yours. The cookie alone is also deleted when a Lopperly support session begins, so the browser's existing identity cannot be stitched onto the account being viewed. Short of those two, they last as long as the table says or until you clear your browser's site data.

PostHog does two more things beyond counting pages and steps. Both are switched on, in PostHog's own dashboard rather than in our code — which is also where it is decided whether every session is recorded or only a share of them, so we describe recording as something that may happen to any given session:

  • It may record your browsing session, with the content masked — a replay of what happened on screen: the pages you moved through, where and how often you clicked, and when you were typing. The text on the page and everything you type are masked, replaced with blanks before the recording leaves your browser, and images and video are blocked, so the replay shows the layout and your path through it rather than the words or the pictures. Recordings are kept for 30 days and then deleted. This is a separate recording from Sentry's in 2.3; both are running, and both mask text and typing and block media in the same way.
  • It captures clicks automatically. Rather than us instrumenting each button, PostHog is told about clicks across the whole site: which element you clicked, what kind of element it is, and where it sits in the page. The text on the thing you clicked is not sent. Nothing has to be added to our code for a click to be captured, and we do not pick which ones are.

For the events our own code sends, we strip out coordinates and free text first. Map positions, search terms, listing titles and descriptions, pickup notes, and email addresses, phone numbers and names are removed. We also strip coordinates and search terms out of the page address attached to every event, automatic ones included, and mask the tracking identifiers advertising networks add to links. That matters most on the map, whose address bar contains the point you are looking at — which, the first time you open it, is often where you are.

Masking is not the same as removing everything. What remains in a recording or an automatic click is the structure of the page: which elements exist, how they are laid out, which one you interacted with, and when. The web address of a link you click is also kept, and for a listing or a seller that address contains a readable name, and the town — it is the page's public web address, the same one anyone visiting the page would see. The stripping described above is a separate mechanism, applied to the events our code names; masking is what covers the automatic capture.

While a Lopperly support session is viewing your account, no analytics are recorded at all and no session is recorded.

PostHog data is processed by PostHog, Inc. under their Privacy Policy.

2.3 Errors and Session Replay — Sentry

We use Sentry to catch errors and slow pages. Alongside the error itself, Sentry records session replay: a reconstruction of what happened on screen — pages, clicks, and navigation — so a bug report is something we can watch rather than guess at. This is the second session recording on the site; PostHog's is described in 2.2.

The scope is broader than an error report, so it is worth stating exactly:

  • Roughly 1 in 20 browsing sessions is recorded, whether or not anything goes wrong.
  • Any session in which Sentry records an error is recorded. Not every error reaches Sentry — one browser quirk we know about and cannot fix is discarded before it is sent, and an error we never see does not trigger a recording.
  • Text on the page and anything you type into a form are masked in the recording and images and video are blocked — exactly as they are in PostHog's, described in 2.2. What the recording shows is the shape and flow of the page, not its words or its pictures.
  • While a Lopperly support session is viewing your account, Sentry is not started at all — no errors, no recording, and no sessionStorage entry.

Like PostHog's, this does not go to Sentry directly: it is sent to an address on our own domain (lopperly.com/monitoring) and our server passes it on.

Sentry keeps its recording identifier in sessionStorage, which lasts until you close the tab. It does not set a cookie. Sentry data is processed by Functional Software, Inc. under their Privacy Policy.

2.4 Maps — Mapbox

Map tiles and static map images are loaded by your browser directly from Mapbox. Mapbox therefore sees your IP address and which area of the map you are looking at. The map library also keeps an identifier in localStorage (mapbox.eventData…) and reports map loads to Mapbox. This is part of how the map works and cannot be separated from it. See Mapbox's Privacy Policy.

2.5 Anti-Spam — Google reCAPTCHA

Our contact form uses Google reCAPTCHA to tell people from bots. The reCAPTCHA script loads only when you open the contact dialog — not on the rest of the site — and Google may set its own cookies and read information about your browser in order to score the request. See Google's Privacy Policy.

2.6 Instagram Posts — Meta

Some business and organization pages show that business's Instagram post. When one scrolls near your screen, your browser loads Instagram's embed script and the post itself from Meta, which may read or set its own Instagram cookies and sees your IP address and which Lopperly page you are on. Nothing is requested until the embed comes into view.

This only happens on a page that carries an embed — the public page for a business or organization, and the panel that opens when you select one on the map — and only when that business has added an Instagram link and has not turned the embed off. See Meta's Privacy Policy.

2.7 Payments — Stripe

Payments and seller payouts are handled by Stripe on Stripe's own pages. When you are sent there, Stripe may set cookies or use similar technologies to detect fraud and secure the transaction. These are governed by Stripe's Cookie Policy.

2.8 Pictures Held on Somebody Else's Server

A few of the pictures on Lopperly are not stored by us. A donation partner's logo and banner are kept as a web address rather than as a file, and it can point at any host on the internet; some older business logos and event photos are the same, saved as addresses before we moved to uploading the files. Your browser fetches those from that host as it draws the page — you do not click anything — so the host sees your IP address and which Lopperly page you are on, and can set its own cookies while answering.

There is no company to name here. It is whichever host a particular address points at, and the next entry can point somewhere else entirely, so this one cannot be listed the way the sections above are.

This happens on the public page for a business or organization, the page for one of its locations, an event's page, the panel that opens when you select a business on the map, and, once you are signed in, the donation partner list and the list of businesses you follow. Everywhere else the pictures come from our own storage. Blocking these costs you nothing but the picture: the page works without it.

3. What We Do Not Do

  • We do not use cookies for targeted advertising
  • We do not sell data collected via cookies to third parties
  • We do not use cookies to build personal profiles for advertising networks

4. Managing Cookies

We do not show a cookie banner, and there is no setting in Lopperly that turns analytics or either session recording off. Nothing in Section 2 is something you can decline. That is the point worth being plain about, rather than pointing you at a control that does not exist.

Not all of it runs everywhere, though, and none of that is a choice you make. The PostHog and Sentry SDKs are active site-wide — except while a Lopperly support session is viewing your account, when neither is started at all. What each one records is not the same: PostHog may record any given session — recording is on, but the share of sessions it captures is a setting in PostHog and not a number fixed in our code — while Sentry records roughly 1 in 20 sessions plus any session in which it sees an error, as Section 2.3 sets out. The rest depends on the page: Mapbox loads where there is a map, reCAPTCHA only inside the contact dialog, Instagram only where a business has an embed, Stripe only on Stripe's own pages, and an outside image host only where a page carries a picture that points at one.

What you can do is browser-side:

  • Clear or block cookies and site data for lopperly.com in your browser's settings. Clearing the ones in Section 2.1 will sign you out and forget your language.

  • A content blocker will stop most of Sections 2.2 to 2.8 from loading. Note that both our analytics and our error reports are served from our own domain, so a blocker that works by domain name may not catch them.

  • Blocking Mapbox will stop the map from working, and blocking reCAPTCHA may stop the contact form from being accepted.

  • Chrome

  • Safari

  • Firefox

  • Edge

5. Changes to This Policy

We may update this Cookie Policy from time to time. Changes will be posted on this page with an updated "Last Updated" date. Material changes will be communicated via the Platform or email.

6. Contact Us

If you have questions about our use of cookies, please contact us:

Lopperly LLC 13209 Valle Verde Terrace Poway, CA 92064

hello@lopperly.com