Effective August 22, 2026 · Operated by Lamplight Technology Consulting LLC
This is the complete list. It is generated from the same configuration file the site runs on, so it cannot fall out of date with what actually happens in your browser.
| Name | Type | Category | Purpose | Retained |
|---|---|---|---|---|
cc_consent | Cookie | Strictly necessary | Stores your cookie preferences so we don't ask again | 12 months |
stytch_session_tokenSet by Stytch | Cookie | Strictly necessary | Keeps you signed in | 30 days |
sk_pending_org_name, sk_pending_user_name, sk_is_signup, sk_pending_invite | Cookie | Strictly necessary | Carries your organisation name and invite through the sign-in email link, so the account can be created when you come back | 30 minutes |
sk_attribution | Cookie | Strictly necessary | Remembers which page and campaign you arrived from, so we can record how you found us when you finish signing up | 30 minutes |
sk_impersonate_org_idSigned-in app only | Cookie | Strictly necessary | Used only by our own support staff when viewing your account to help with a problem | Session |
__ph_opt_in_out_*Set by PostHog | Browser storage | Strictly necessary | Remembers that you declined analytics, so we keep honouring it | Until cleared |
ph_*Set by PostHog | Browser storage | Analytics | Recognises a returning visitor so repeat visits aren't counted as new people | 12 months |
DonorShepherd does not show a cookie banner, because there is nothing to ask you about. We set only the cookies listed above as strictly necessary — the ones that keep you signed in and remember your preferences.
We do use a product-analytics service (PostHog) to count page views on this marketing site, but we run it in a cookieless mode: it stores nothing on your device, and it cannot recognise you on a later visit. If you come back tomorrow, you are counted as a new visitor. That is the trade we have chosen — less precise numbers for us, nothing stored on your device.
If we ever want to go further than that, this page changes first and a consent banner appears before anything else is stored.
Everything above concerns this public website. The signed-in application — where you work with your donor records — is treated differently: it runs the same cookieless page counting and nothing more. No analytics provider receives your donors' names, email addresses, giving history, or the notes you write about them, and we do not record sessions or replay screens inside the application. This is not a setting you or we can switch on; it is enforced in the code that decides what may run.
See our Privacy Policy for how we handle your organisation's data and your donors' records, and our Terms of Service for the agreement itself.