Privacy policy for PostHog apps

What PostHog does on a live site

PostHog is in the analytics category. On sites we scan, it shows up through posthog.com, i.posthog.com. Its role is to measure product usage and, if enabled, record sessions.

Data that may be processed: Page views, clicks, feature-flag evaluations, and a device identifier. Session replay is included if you turned that product on. The vendor describes the location as: The PostHog region you chose (US or EU cloud, or your own host). Their public privacy or data-processing terms are at https://posthog.com/privacy.

A privacy policy for a PostHog app should name PostHog directly and say what your own product sends to it. A phrase like "third-party tools" is not enough once this service is on the page.

PostHog's cloud script is served from a host such as us.i.posthog.com or eu.i.posthog.com, and the browser keeps a key shaped like ph_<project>_posthog. Say whether session replay is on. Replay is a different disclosure from a page-view counter.

What you still have to type

The scan cannot know your company name, the country you operate from, or the support email you want on the page. Those go in a short form after the scan. The legal clauses around them are fixed template text, marked as a draft until a lawyer reviews them.