3. Cookies we use
These are the cookies and similar tools we use:
cookie_consent_v1 (Sledge, Necessary, 1 year). Remembers your consent choice.
sledge_aid (Sledge, Necessary, 2 years). A random, anonymous visitor ID. It is the subject of your consent record and, if you accept analytics, the ID product analytics starts from.
token, auth_state and userId (Sledge, Necessary, 1 day). Keep you signed in and tell the app which account is active. The sign-in session itself lasts 1 day, 7 days, or 30 days depending on how you signed in and whether you asked us to remember you; these cookies are refreshed while that session is alive.
device_id (Sledge, Necessary, 1 year). A random ID for this browser, used to recognise a known device during sign-in and to spot suspicious logins.
oauth_exchange, oauth_login_state and apple_oauth_state (Sledge, Necessary, minutes). Short-lived values that carry a sign-in through Google, Microsoft or Apple and protect it against request forgery. They are cleared as soon as the sign-in finishes.
_GRECAPTCHA (Google reCAPTCHA, Necessary, 6 months). Helps stop spam. It is set when you start filling in a public form, such as the waitlist, to tell a person from a bot. It is a security measure, not analytics. It is never used to profile you or to advertise, and it is not tied to your consent choice, because a spam check that a bot can switch off would not work.
_ga and ga* (Google Analytics, Analytics, 2 years). Tell visitors and visits apart for website analytics. Set only after you accept analytics. When you are signed in to Sledge and have accepted analytics, we also give Google Analytics your account's pseudonymous id (never your name or email), so we can see which source first brought your company to us.
ph_*_posthog (PostHog, US cloud, Analytics, 1 year). Product analytics inside the app. Set only after you accept analytics.
swan.sid (Swan, Marketing, stored in your browser until cleared). The visitor identification service described in our Privacy Policy. Loaded only after you accept marketing.
_fbp and _fbc (Meta pixel, Marketing, 90 days). Measure which of our Meta ads lead to a quiz answer or a demo booking, and let Meta show our ads to people who visited. Loaded only after you accept marketing.
bcookie, li_sugr, lidc, UserMatchHistory and AnalyticsSyncHistory (LinkedIn, Marketing, 24 hours to 1 year). Set by the LinkedIn Insight Tag, which gives us LinkedIn's Website Demographics (aggregate reports on the industries, job titles and company sizes of our visitors, with no individual named) and matches visitors to LinkedIn accounts. We use it for those reports even while we run no LinkedIn ads; if we run them, it also measures their results. Loaded only after you accept marketing, never when Global Privacy Control is on, and only on our public website pages. Lifetimes are from LinkedIn's published cookie table: lidc 24 hours, UserMatchHistory and AnalyticsSyncHistory 30 days, li_sugr 90 days, bcookie 1 year.
Apollo website visitor tracking (Apollo, Marketing; cookie names and lifetimes set by Apollo). Identifies which company a visit to our public website came from, so our sales team can follow up. Loaded only after you accept marketing, never when Global Privacy Control is on, and only on our public website pages. Not switched on yet: we will list its cookies by name and ask for your consent again before it is.
Advertising identifiers, such as gcl* (Google, and any other advertising network we add a tag for, such as Meta or LinkedIn; Marketing; length set by each network). Measure whether our ads work. Google Consent Mode keeps advertising storage turned off until you accept marketing, so no advertising identifier is set before then, and withdrawing your consent turns it off again.
Local storage. Alongside cookies we keep a small amount of data in your browser's local storage: sledge:geo-location, the city and state resolved from the location you allowed on the home page, so the page can show local weather without asking again. Clear it by clearing site data, or by changing the location on your profile. sledge_quiz_attribution remembers which link first brought you to our quiz (a creator code or campaign tag, and the site you came from), so whoever shared it is credited. It is Necessary, stays in your browser, and is sent to us only with quiz answers you choose to submit.
Change log. On September 13, 2026 we added _GRECAPTCHA (Google reCAPTCHA, anti-abuse) to the table. It is a Necessary cookie, which is not subject to your consent choice, so it does not change what version 2 asked you to agree to and does not require a new consent.
Change log
November 5, 2026. Named the LinkedIn Insight Tag (bcookie, li_sugr, lidc, UserMatchHistory, AnalyticsSyncHistory) as a marketing cookie, used for LinkedIn's free Website Demographics reports even without LinkedIn ads. A newly named marketing vendor is a material change, so this is version 4 and everyone is asked for consent again. Described the account id we give Google Analytics for signed-in users who accepted analytics, and listed Apollo website visitor tracking, which is not switched on. When it is, its cookies will be named here and the policy version will change so everyone is asked again.
October 27, 2026. Added the Meta pixel (_fbp, _fbc) as a marketing cookie and the quiz's attribution storage. A new marketing vendor is a material change, so this is version 3 and everyone is asked for consent again.
October 23, 2026. Listed the sign-in, device and OAuth cookies that were missing, corrected how long a sign-in lasts, and added the local storage we keep.