Cookies and Tracking
Last updated: November 4, 2026
Short version: this website uses Google Analytics, which sets two cookies of its own. Whether it waits for your permission depends on where you are, and the section below says exactly how. A browser that asks sites not to track it doesn’t get them at all. Nothing here follows you between sites. A few other things write to your browser, and every one of them is named below. Most are the site doing its job. One holds the tags on the link you arrived through, if it had any, so a sign-up can say which place brought you.
Cookies on this website
- An invitation cookie, named
bht_ref, and only if you arrive through somebody’s invite link. It holds the eight character invite code so the person who invited you gets credit when you sign up, it lasts 90 days, and it is readable only by our server rather than by any script on the page. It contains nothing about you.
It is not used to profile you and it is not shared with anybody. There is no advertising cookie. Google Analytics’ two cookies are described under What we measure, below.
What this website keeps in your browser
Four things, and this is the whole list. None of them is a cookie, so none of them is sent to us on every request. They sit in your browser’s own storage and you can clear them from its settings at any time.
bh_cookie_consent, in local storage. Your answer to the analytics question, so we stop asking. It holds one word.bh_portal, in local storage. Your sign-in for the support bubble and the careers form, if you use either. It is cleared when you sign out.bh_sso_n, in session storage. A random value that lasts one sign-in, so a link somebody else made cannot sign you into their account. It is thrown away the moment you come back, and session storage empties when you close the tab.bh_src, only if you arrive through a link carrying tags. It holds the link’s three short words, naming the site that sent you, the kind of link and the campaign, so that if you sign up they go with your account. Nothing about you is in it. It sits in session storage, which empties when you close the tab. Where analytics is on for you, a copy also stays in local storage for 30 days, so a sign-up a few days later still says where you came from. Switching analytics off, or signing in to the app at buhata.com/app, removes that copy.
The app at buhata.com/app keeps more than this, mostly because it has to work with no internet at all. That is the section below.
Our hosting provider, Cloudflare, may also set a short-lived cookie of its own to tell human visitors from automated traffic. That is a security measure rather than a choice we make, and it carries no advertising identifier.
Storage inside the app
The app is a different matter. It keeps your data on your device so Buhata runs with no internet at all, and it keeps a sign-in token so you are not asked for your password every time you open it. It also keeps one small record for us, buhata_usage: how many times each tool was opened and how many times something was saved in one, day by day, until a finished day’s totals have been sent. Nothing you typed is in it, and nothing that names you or your Space. What we measure, below, says where it goes. Signing out removes the token. Deleting the app removes the rest.
None of that is used to profile you, none of it is shared, and there is no identifier in it that follows you to any other website, because Buhata is not on any other website.
What we measure
Google Analytics, on this website only, added in September 2026 so we can see which pages get read and which get abandoned. When it runs, it sets two cookies, _ga and _ga_5KZ3THXL5F, and sends Google the page you viewed with your IP address shortened. The cookies hold a random number that lets Google Analytics recognize the same browser when it comes back. They last two years from your latest visit unless you clear them, and declining takes both away. It does not run inside the Buhata app, on the share pages, or on the invite pages. There is still no session recorder, no heatmap and no advertising pixel.
When a page here, or the app at buhata.com/app, opens from a link carrying tags, it tells us once for that tab, and we add one to that day’s count for those three words. The count is the day, the words and a number, with no address or account attached. A share page counts its own visits the same way, as a share of whatever kind of thing was shared, and its links to Buhata carry those words.
Whether it asks first depends on where you are, which we read from your connection. In the European Union, the wider European Economic Area and the United Kingdom, it is off until you accept the cookie notice, and if you decline, nothing from Google is loaded at all. In California, and anywhere in the United States when we can’t tell which state you’re in, it’s on when the page opens, a notice says so, and the switch in that notice turns it off. Everywhere else it is on without a notice. Wherever you are, your answer is remembered so you are not asked again, and the Cookie Policy link at the foot of every page brings you here with your choice open, so you can change it at any time. If we cannot tell where you are, you get the asking version.
Inside the app, at buhata.com/app and in the apps for phones and computers, we count which tools get used. Each day your device adds up how many times each tool was opened and how many times something was saved in one, and once the day is over it sends us those totals with no sign-in, account, Space or device identifier attached, and nothing you typed. We add what every device sends into one total per tool per day, so nothing in them can be traced back to you. Counting sets no cookie, and Google gets none of the totals. Which tools get used, in the Privacy Policy, says the rest.
Where the typefaces come from
These pages load two typefaces, and both files are served from buhata.com. They used to come from Google Fonts, which meant your browser asked Google for them and Google saw the address it came from. That request is gone: the font files sit on our own server now, so your browser no longer asks Google for them, and the banner that asked you about it is gone too. If you answered that banner in the past, the one word it saved in your browser is still there and is read by nothing.
Other companies involved
The full list of companies that touch anything, and what each one gets, is in the Privacy Policy rather than repeated here, so there is one list to keep honest instead of two.
Do Not Track and Global Privacy Control
If your browser sends either signal, Google Analytics doesn’t load on this website, wherever you are and whatever you answered before, and no notice asks you about it. Turn the signal off and your earlier answer applies again. The app at buhata.com/app, opened in a browser that sends either signal, keeps no tool counts and sends none. With either signal, the tags a link carried are kept for the tab only.
Contact
Questions or requests: [email protected].
Buhata LLC, United States. Our full postal address is in the Terms.