Cookies & tracking technologies

Public website

The landing loads its scripts, styles, fonts and product images from its own origin. It does not install a Meta Pixel, Google Analytics, session replay, embedded social widget or fingerprinting library. There is no persistent visitor ID in cookies, localStorage or sessionStorage. Form values stay in page memory until submission; an idempotency reference is used to prevent duplicate submissions.

First-party analytics sends only an allowlisted event name and page variant to our own API. It does not send form fields, page query strings, social content or a visitor ID. Do Not Track is respected. The hosting provider necessarily processes network information to serve and protect requests; see Privacy for the distinction between application analytics and infrastructure logs.

Private workspace

__Host-dl_session is a strictly necessary operator authentication cookie, set only after sign-in. It is Secure, HttpOnly and SameSite=Strict, has path / and no Domain attribute. It contains an opaque random reference, not a name, email or a readable access token. Its lifetime is at most one hour; the server also enforces 15 minutes of inactivity and supports revocation.

Browser JavaScript cannot read this cookie. Authentication tokens are kept server-side. Signing out deletes the current server session and expires the cookie; signing out all devices revokes all operator workspace sessions.

Future tools

No empty cookie banner is shown. If optional tracking is added, it must remain blocked until the required choice, with equally accessible acceptance and refusal, granular options and a simple way to withdraw. Marketing consent must be separate and optional. Our build checks guard the public landing against known tracker SDKs and browser storage use; changes also require a browser network and storage review.