Cookies & Storage
We use only the storage described here. Optional analytics remain off until you choose otherwise.
Essential authentication
growth_session: first-party, HttpOnly, SameSite=Lax, Secure over HTTPS; up to seven days. It authenticates your account. growth_server_key: first-party, HttpOnly, SameSite=Strict; five minutes; shows a newly generated server key to the signed-in owner. Never share this cookie or its content.
Preferences
growth_privacy: first-party choice/receipt cookie, up to 180 days. Stores the privacy notice version, optional analytics choice and receipt identifier, not a marketing profile. growth-theme: localStorage preference retaining light/dark appearance until cleared. These preferences support your requested settings.
Optional analytics
On offer pages, sessionStorage entries prefixed view: suppress duplicate page-view counts after analytics consent. Connected-site tracker.js uses sessionStorage growth-session:<site> with a random session ID and a 30-minute inactivity expiry after consent. It also uses localStorage growth-visitor:<site>, a random per-property browser reference expiring after 30 days, to count returning browsers across sessions. Identifiers are hashed separately per property on the server. This counts browsers, not verified people. Storage being unavailable, cleared or expired and using different devices affects uniqueness. It does not install a cross-site identifier or advertising cookie. When consent is withdrawn, it stops sending events, submits the random browser/session references for server-side blocking and erasure of all retained linked sessions, and removes local references. Delivery failures require a backend or operator follow-up; a request already in flight cannot be recalled. Source/campaign labels are processed without retaining the full query string.
Control
Choose Essential only, allow analytics or save an individual choice. Reopen Privacy choices at any time to withdraw just as easily. On customer websites and mobile apps the customer must integrate its own consent interface and call the tracker only after the appropriate permission. Do Not Track and Global Privacy Control suppress our browser tracker. Other scripts on a customer site may need their own choices.
Source framework: GDPR and EDPB consent guidance. Customer-specific legal assessment and production review remain necessary.