Privacy on /prehog

Why this page is different

benlive.tv/prehog is a working PostHog implementation, built to demonstrate PostHog competence for a job application, so it runs a few things unique to this page: Session Replay (masked, scoped to this page only), a short post-completion survey, and, as of this page's "Ask about PostHog fit" chat, an AI chat feature whose message content is sent to a different third party than PostHog entirely (see "AI chat messages" below). The shared analytics layer covering the rest of the site (see the site-wide privacy page for what that collects) skips all three.

What's collected, and why

Page views

PostHog's standard $pageview autocapture, fired once on load. Answers "did anyone open the page."

Slide progress

Eight small events tied to the deck's own nine sections: which section is active (in either view mode, see below), how you navigated (click, arrow key, swipe, dot, Contents panel, scrolling), whether you reached the end, whether the auto-advance timer is playing or paused, whether you opened the "what does this page measure" panel, which evidence links you clicked through to, and whether you switched between the guided and browsable layouts. The eighth is hidden, rewarding close reading: it's left for a visitor to find on their own. Each exists to answer one specific, stated question about whether the presentation itself works, kept narrow and single-purpose by design. The full list, with the exact question each answers, is in this repo's own analytics.md.

Chat engagement (product-level only)

Four more small events for the "Ask about PostHog fit" chat: whether you opened it, which preset starter question you used, recorded only as a fixed label like culture or throughline, whether you actually sent a message (once per session), and whether you reset the conversation. These events always carry only their own name and that label — your message text and the AI's response stay off them entirely. See "AI chat messages" below for where that content actually goes. Documented alongside the slide-progress events in analytics.md.

Session Replay

Turned on for this page only, with maskAllInputs: true. It exists to answer one specific question: is the slide navigation discoverable on a phone? It's meant to come off once that's answered: temporary by design. The entire chat dialog is additionally masked as rendered text (beyond its input field), the same treatment the survey's free-text answer gets: maskAllInputs alone only covers text while it's being typed into an input, so the message bubbles the chat renders afterward need that extra masking to be covered too.

A short survey

Shown once, after you reach the final slide: a 1–5 rating and one optional open-text question, masked in Session Replay even though the response itself is recorded as normal survey data.

AI chat messages

Typing a question into the "Ask about PostHog fit" chat sends that text to my own Firebase Functions backend, which forwards it to OpenRouter's free tier. This feature normally requests NVIDIA's Nemotron 3 Super first, but if that model is unavailable the backend automatically retries with a different free model, in order: Google's Gemma 4, OpenAI's GPT-OSS 20B, then OpenRouter's own zero-cost router. Which model actually handles your message depends on availability — Nemotron is only the first choice, and it could end up being any of these. (During my own local development a self-hosted Ollama model is used instead; production always uses the chain above.) Each of these is a separate provider, each with its own retention and training policy:

• NVIDIA's free Nemotron endpoint currently states that usage "is logged for security purposes and to improve NVIDIA products and services." See the current OpenRouter/NVIDIA provider policy for this model for the exact current wording, which supersedes this summary if it changes.
• OpenRouter itself states that prompt retention is off by default for routing traffic, but each downstream provider (NVIDIA, Google, OpenAI, or whichever provider OpenRouter's own free router selects) sets its own separate logging and training policy, outside OpenRouter's control. See OpenRouter's provider-logging documentation for how that works, and OpenRouter's own privacy policy for OpenRouter's own terms.

In short: on the free tier used here, assume a message you send may be logged and used to improve a provider's own products, by whichever provider ends up serving it. This content always stays off PostHog. It's a separate destination entirely, handled outside PostHog's SDK altogether. This app itself keeps your questions and the AI's answers only in your own browser tab (refreshing clears the conversation); Firebase Functions additionally logs request metadata (timestamps, status codes, a hashed IP for rate-limiting) for debugging, retained 30 days. Those logs are limited to that metadata and exclude your chat message text entirely. This is the same data-handling model as benlive.tv/ai-lab/chat's own chat feature.

One feature flag

Controls whether a live, self-referential event-log panel is visible to a given visitor: a genuine rollout control, exactly the kind of on/off switch feature flags are meant for.

JavaScript errors

Unhandled exceptions and unhandled promise rejections only, so a bug that only shows up on someone's actual phone in production still gets caught. Nothing else in the console is captured.

Two sessionStorage keys

prehog:autoplay remembers whether you paused the auto-advancing slideshow, so it stays paused across navigation within the same tab. bl:prehog-chat-initiated remembers whether you've already sent a chat message this session, so the "chat engagement" event above fires only once. Both stay entirely within your browser.

One localStorage key

prehog:viewmode remembers whether you last chose the guided (present) or browsable (reference) layout, so your choice persists across visits. It uses the same durable-preference pattern the site's own dark/light theme choice already relies on. It stays entirely within your browser.

What's deliberately not collected

No names, no email addresses, no precise or IP-derived location beyond PostHog's default country-level estimate, and no cross-site identity linking. There's no identify() call anywhere in this page's code, so every visitor stays anonymous to it. The only free text PostHog ever collects is the survey's optional open answer, described above, and only if you choose to type one. Chat questions are free text too, but they stay entirely within Firebase/OpenRouter, away from PostHog, as described above.

Where it goes

PostHog events are sent through t.benlive.tv, a first-party reverse-proxy subdomain that forwards ingestion traffic straight to my own PostHog project. See PostHog's own privacy policy for how they handle it on their end once it arrives. Nothing is sold, shared with third parties for advertising, or used for anything beyond understanding whether this presentation works. Persisted via localStorage+cookie, scoped to this site. Chat messages follow a completely separate path (see "AI chat messages" above) through Firebase Functions to OpenRouter, entirely bypassing t.benlive.tv and PostHog.

Want to see it for yourself?

The "what does this page measure?" panel on slide 6 of the deck shows a live log of every event your own session has actually sent, including your anonymous distinct_id when enabled. The event taxonomy, the reasoning behind every product turned on or deliberately left off, and the full source are public in the prehog repository.