Cookie Policy
This document explains the technologies Pibox uses to store information on your device or read information already stored there, why we use them, and how you decide which of them run.
For brevity we call all of them trackers — cookies, localStorage
entries, pixels, scripts and device identifiers alike. What matters legally
is not the technology but the fact that something is written to, or read
from, your device.
Owner and data controller: Pibox Oy, Rajatorpantie 41 C, 01640 Vantaa, Finland. Contact: support@pibox.com.
Your choice
Trackers that are not strictly necessary run only after you allow them. On your first visit a banner asks; nothing in the Analytics or Marketing groups loads before you answer, and “Reject all” is one click, in the same place and of the same size as “Accept all”.
You can change or withdraw that choice at any time through Cookie Settings in the site footer. Withdrawal takes effect immediately: we stop collecting and delete what those trackers stored on your device.
Your choice is remembered in a single entry (pb-consent) in your browser’s
local storage. It records which groups you allowed, when, and which version
of this policy you were shown. It is strictly necessary — without it we
would have to ask again on every page.
The two groups below are exactly the two switches in the banner.
Strictly necessary
These run without asking, because the service cannot work without them. They are not used to build a profile of you.
| What | Why |
|---|---|
| Session and authentication | Keeps you signed in and ties a request to your account. |
pb-consent |
Remembers the choice you made here. |
pb-theme |
Remembers light or dark appearance. |
| Cloudflare (Cloudflare, Inc.) | Serves the site and filters malicious traffic. Sets a security cookie and reads your IP address. Privacy Policy |
| Stripe (Stripe Payments Europe, Ltd.) | Runs a payment you asked for and screens it for fraud. Loads only on pages where you pay. Privacy Policy |
| Intercom (Intercom R&D Unlimited Company) | The support chat. Identifies you across the conversation so support can answer. Privacy Policy |
| Google Fonts (Google Ireland Limited) | Fonts. Sets no cookie, but fetching the file discloses your IP address to Google. Privacy Policy |
Sign-in with Google and Sign in with Apple load only when you choose them, and only to carry out the sign-in you started.
Analytics
Which pages people open, where they stop, which actions fail. We use this to decide what to build and fix. Nothing here is shared with advertising networks.
Inside the app this works differently. The signed-in app stores nothing on your device for analytics — no cookie, no local identifier — so on that side there is nothing here for you to accept or refuse. What we count instead rests on our legitimate interest, and you can object to it at any time in Settings → Privacy; the choice is saved against your account and applies on every device you sign in from. Session replay in the app is a separate question and stays off until you turn it on.
| Service | What it does |
|---|---|
| PostHog (PostHog, Inc.) | Our own product analytics, hosted on PostHog’s European infrastructure. On this site it keeps an identifier in local storage; in the app it stores nothing on your device. Session replay runs in the app only if you turn it on, and never captures what you type, your audio, or your video. Privacy Policy |
| Google Analytics 4 (Google Ireland Limited) | Aggregate traffic measurement on the marketing site. Privacy Policy · Opt out |
| Hotjar (Hotjar Ltd.) | Heat maps and session recordings on the marketing site. Honours the browser’s Do Not Track setting. Privacy Policy · Opt out |
| Mixpanel (Mixpanel, Inc.) | Product analytics in the older web app, being retired. Privacy Policy |
| Beamer (Beamer, Inc.) | Shows release notes in the app and records which you have already seen. Privacy Policy |
Marketing
These connect your visit here to an advertisement you saw elsewhere, or to a partner who referred you. They are the reason a product you looked at once follows you around the web, and they are entirely optional.
Two of them go further than advertising and try to work out who you are: one identifies the company you work for from your IP address, the other identifies you personally. Neither runs unless you allow this group, and refusing costs you nothing in the product.
| Service | What it does |
|---|---|
| Google Tag Manager (Google Ireland Limited) | Loads the tags below. It collects nothing by itself, but it is the mechanism by which the rest run, so it is gated with them. Privacy Policy |
| Meta pixel (Meta Platforms Ireland Limited) | Measures conversions from Facebook and Instagram advertising. Privacy Policy · Opt out |
| LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) | Measures conversions from LinkedIn advertising. Privacy Policy · Opt out |
| Google Ads (Google Ireland Limited) | Measures conversions from Google advertising. Privacy Policy · Opt out |
| HubSpot (HubSpot, Inc.) | Records visits and links them to a contact record when you submit a form. Privacy Policy |
| Branch (Branch Metrics, Inc.) | Matches a link you opened elsewhere with the session that follows, so an invitation opens in the right place. Privacy Policy |
| FirstPromoter (FirstPromoter SRL) | Attributes a signup to the partner who referred it. Privacy Policy |
| Rewardful (Rewardful Inc.) | The same, for a different partner programme. Privacy Policy |
| RB2B | Identifies the individual person visiting the site — name, professional profile, work email address — and reports it to us. Privacy Policy |
| Albacross (Albacross Nordic AB) | Identifies the company a visitor works for from the IP address, so sales knows which businesses looked at the site. Privacy Policy |
| ActiveCampaign (ActiveCampaign, LLC) | Marketing automation. Connects a visit to a contact record and to the emails that contact has received. Privacy Policy |
Controlling trackers in your browser
Browsers can block or delete cookies independently of the choice you make here: see the instructions for Chrome, Safari, Firefox and Edge. To opt out of interest-based advertising more broadly, see YourOnlineChoices in the EU or the DAA in the US.
If you refuse
Refusing costs you nothing in the product. Everything you pay for keeps working; we simply learn less about how it is used, and advertising you see elsewhere becomes less relevant rather than less frequent.
Transfers outside the EU
Several providers above are established outside the European Economic Area, mainly in the United States. Where that is the case, the transfer relies on an adequacy decision of the European Commission, on the provider’s certification under the EU–US Data Privacy Framework, or on Standard Contractual Clauses in our agreement with that provider. Write to support@pibox.com to find out which applies to a given provider and to receive a copy.
Data subject rights, and everything else
How long we keep data, on what legal basis, who else receives it and what you can demand of us is set out in the Privacy Policy.
Changes
When this list changes materially we publish a new version of this document and ask for your choice again. Every version we have ever published stays available at /legal, because records of consent name a version.