Last updated: September 21, 2026 · Version 1.2 · Changelog
Histriva is operated by Evenstride, Inc., a Delaware corporation, which is the data controller for the cookies and browser storage described here. Histriva is a product and brand owned by Evenstride, Inc.
Every cookie and browser-storage entry Histriva uses, what it is for, and how long it persists. No dark patterns — you are not required to accept optional cookies to use the site. Required cookies (session, security) cannot be disabled because the site cannot function without them; optional cookies (analytics) are off by default and only turn on after you explicitly accept.
Why: keeps you signed in after you log in. Without this, every page load would send you back to the sign-in screen.
How long: 30 days, then you are signed out and prompted to log in again.
Why: protects form submissions from cross-site request forgery attacks. Required for secure use of anything that changes your data.
How long: per session (cleared when you close your browser or sign out).
Why: anonymous behavioral events (e.g. "habit_created," "onboarding_completed") that help us understand which features people actually use. We never send message content, AI responses, or personal identifiers — only the event name and a user identifier scoped to our project.
How long: up to 12 months per PostHog's default retention.
Default: off. Only activates after you click "Accept analytics" on the consent banner you saw on your first visit. You can change your mind any time.
Why: when something in the app breaks, we capture the exception so we can fix it. PostHog records the exception alongside your session replay so we can see what was happening on screen when the error occurred. Sentry receives a parallel report for our engineering alerts.
What it captures: error messages, stack traces, the URL where the error happened. Tied to your session ID.
What it does NOT capture: form values, text content, or any session-replay material that the masking config doesn't already redact.
Default: off. Tied to the same analytics consent.
Why: when you opt in to analytics, PostHog also records the shape of your session — clicks, scrolls, and which screen you're on — so we can find and fix UX friction during the private beta.
What it captures: page layout, button clicks, navigation, scroll position.
What it does NOT capture: any readable content. Every text node and every
input value is masked at the recorder. Replays show **** in place of habit
names, mood reflections, chat messages, or anything else you type. We cannot read
your data from a replay even if we wanted to.
Default: off. Tied to the same analytics consent — declining analytics declines session replay too.
How long: up to 30 days per PostHog's default replay retention.
histriva_attr)Why: records how you first arrived — the campaign tags in the link you
followed (for example utm_source=newsletter) and the name of the site that
linked to us — so that when you create an account we can tell which of our
outreach channels actually brings people in. It is a first-party cookie; it is
never sent to an advertising network.
What it holds: only those short tags and the linking site's domain name. No identifier, no browsing history, nothing you type.
Default: off. Set only after you accept analytics, and deleted if you later decline.
How long: 7 days at most, and deleted as soon as you sign in — once your account records where you came from, the browser copy has no further use.
Browser storage keys used by Histriva. Nothing sensitive is stored in local storage — these are UI preferences and feature state, not identity or auth material.
histriva_analytics_consent — your analytics consent choice ('true' /
'false').histriva_theme — your chosen theme (dark, light, or warm). Persists across
sessions.histriva-offline (IndexedDB) — habit completions queued while offline, synced
to the server when connectivity returns. Cleared on successful sync.Analytics consent is a one-click toggle in Settings. Declining will immediately stop PostHog from capturing new events and opt out of future collection. Existing analytics data is retained until the PostHog retention window expires, unless you also request account deletion — in which case your analytics data is deleted along with everything else.
Email privacy@histriva.com.