[8ddieHu0314]

Summary

Adds PostHog to the frontend for product analytics and session replay and updates the privacy policy

Changes

• Adds PostHogProvider to the root layout. When NEXT_PUBLIC_POSTHOG_KEY is set, it records pageviews (including App Router navigation) and clicks, and identifies signed-in users by their Supabase user id.
• Calls posthog.reset() before signOut() in all five sign-out controls. Sign-out redirects without reloading the page, so the auth listener alone would miss it.
• Updates the privacy policy to cover analytics, session recordings and surveys, and documents the env vars in ONBOARDING.

How to test

1. Add NEXT_PUBLIC_POSTHOG_KEY and NEXT_PUBLIC_POSTHOG_HOST (check Slack) to frontend/.env.dev, run pnpm install`, then start the backend and frontend as usual. Open PostHog → Activity → Live events.
2. Signed out: open /buyer/browse and click into a fundraiser. You should see a $pageview for each page (the second without a page reload) and a click event, under an anonymous id.
3. Buyer: sign in with a Cornell Google account. You should see $identify, then events under your Supabase user id. Sign out from the account menu: the next pageview uses a new anonymous id.
4. Admin (optional): add your email to ADMIN_EMAILS in backend/.env.dev, open /admin, and sign out from its header. You should see the same switch to a new anonymous id.
5. Replay: in PostHog → Session replay, your session should be listed and play back the pages you visited.
6. No key: remove NEXT_PUBLIC_POSTHOG_KEY and restart. The app should work normally and send nothing to posthog.com

Checklist

• Targets main
• Runs locally with pnpm assemble and both dev servers
• If schema.prisma changed: migration file is included and existing rows are backfilled
• If common/ changed: pnpm build in common and both consumers updated
• No .env* files, keys, or real user data in the diff or screenshots
• I read every line of this diff and can explain it in review

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
curaise	Ready	Preview	Oct 28, 2026 6:02pm UTC

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: QUIET
• Plan: Advanced
• Run ID: ddf3f742-7d2b-4285-89ec-02a77b8c0171

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}