Cookie policy

The short version

• One cookie keeps you signed in. Without it the app cannot work.
• Google Analytics runs on the live site only, with your IP address anonymized.
• If you are in the EEA or the UK, analytics does not load until you say yes.
• There are no advertising cookies, no cross-site trackers, and no profiling.
• We never put your email address, your account list, or anything read from Gmail into a cookie.

Your choice

Visitors in the European Economic Area and the United Kingdom see a banner on their first visit asking about analytics. Until you choose, the analytics script is not sent to your browser at all. We do not load it and hide it, and we do not set a cookie and wait: the tag is left out of the page server-side, so there is nothing to block.

Your answer is remembered in a small preference cookie (cookie_consent) for six months. You can change it whenever you like using the Cookie settings link in the footer, or by clearing cookies for this site. Declining costs you nothing: every feature works the same either way.

Outside the EEA and the UK, analytics runs by default, and the opt-out methods below all still work.

Strictly necessary

These make sign-in and form submission work. They cannot be turned off without breaking the app.

• Consent preference (cookie_consent). Remembers whether you accepted or declined analytics, so we stop asking. Set only after you answer the banner.
• Session cookie (session). Holds a signed reference to your user record so you stay logged in between pages. It is HttpOnly (JavaScript cannot read it), Secure in production (sent over HTTPS only), and SameSite=Lax (not sent along with cross-site requests). It expires after one hour of inactivity, and clears immediately when you log out.
• CSRF token. Stored inside that same session cookie, not as a separate one. It proves that a request that changes something came from you on our site and not from another tab.
• OAuth state. A short-lived value written during Google sign-in and discarded the moment the round trip finishes. It is what stops someone else's sign-in from being swapped into your session.

Analytics

We use Google Analytics 4 to see how many people reach the site, which pages they read, and where they drop out of the sign-up flow. It sets its own cookies (typically _ga and _ga_<id>) to tell a returning visit from a new one.

Two things narrow what it sees. Analytics is disabled entirely in development, so it only ever runs on the live site, and anonymize_ip is switched on, so your IP address is truncated before Google stores it. We do not use Analytics for advertising, we do not enable ad personalization or remarketing, and we never send it your email address or anything derived from your mailbox.

Our Content-Security-Policy allows scripts and connections from Google Analytics and Google Tag Manager only. No other third-party script can load on this site.

Turning analytics off

Any of these work, and none of them break the app:

• Block or clear cookies for this site in your browser settings.
• Install Google's Analytics opt-out browser add-on.
• Turn on your browser's tracking protection or "Do Not Track" setting, or use a content blocker.

Blocking the strictly necessary cookie is different: you will not be able to stay signed in, so the account pages will not work.

Third-party pages

Signing in sends you to Google's own consent screen, and some links here go to Google Forms. Those pages set their own cookies under Google's policies, which we do not control.

Questions

Write to support@tombstonepro.com.