Nothing is stored
until you choose.
This page lists every value importable.io can write to your device, what writes it, and how long it stays. Processing — what the forms collect, who receives it, how long it is kept — is on the privacy page.
What is set today: nothing.
The analytics tag is not configured on this deployment. No measurement ID is set, so no Google script loads, the consent banner does not appear, and this site writes no cookie and no local-storage entry. There is nothing to accept and nothing to decline.
The rest of this page describes what happens when the tag is turned on, so the record exists before the switch is thrown rather than after.
Everything this site can store.
| Name | Kind | Purpose | Lifetime |
|---|---|---|---|
| importable.consent.analytics.v1 | Local storage This site | Holds your answer to the consent banner as the single word granted or denied. Without it the banner would ask again on every page load. Strictly necessary | Until you clear site data |
| _ga | Cookie Google Analytics | Tells one browser apart from another so a visit can be counted once. Analytics — consent required | Set and expired by Google. Not set today |
| _ga_<stream> | Cookie Google Analytics | Holds session state for one measurement stream. Analytics — consent required | Set and expired by Google. Not set today |
The consent key is strictly necessary and is written whichever way you answer. It is the record of a choice you made, and it is the reason we do not ask again on the next page. It stays on your device; it is never sent to a server.
No analytics storage and no advertising storage is written before consent. That is enforced at the tag, not promised in prose — see the next section.
The default is denied.
A short blocking script runs before the Google tag can load and sets Consent Mode v2 to these values. The browser executes it during parse, so the defaults are in place first. Ordering is guaranteed by the HTML specification, not by luck.
| Signal | Default | Meaning |
|---|---|---|
| ad_storage | denied | Advertising storage. Never granted by this site. |
| ad_user_data | denied | Sending user data for advertising. Never granted by this site. |
| ad_personalization | denied | Personalised advertising. Never granted by this site. |
| analytics_storage | denied | The only signal your answer changes. |
| functionality_storage | granted | Storage the page needs to work at all. |
| security_storage | granted | Storage used for abuse prevention. |
| wait_for_update | 500 | Milliseconds the tag waits for a stored answer before acting on the default. |
Accepting updates one signal: analytics_storage. The three advertising signals stay denied whatever you answer, because this site runs no advertising and asks for no permission to.
What each answer does.
| You | The site |
|---|---|
| Accept | Writes granted to local storage and updates analytics_storage. Google may then set the two cookies above and page views are counted. |
| Decline | Writes denied to local storage. Storage stays denied, no analytics cookie is set, and no event leaves your browser. |
| No answer | The default stands, which is denied. Nothing is written to your device at all until you answer. |
Changing your mind.
The footer of every page carries a control labelled Cookie choices. It reopens the banner so you can answer again, and withdrawing is one click, the same as giving. The control appears when the analytics tag is configured; with the tag off there is nothing to change, so it stays hidden.
Clearing site data in your browser removes the stored answer. The banner then treats you as a first-time visitor, and the default is denied.
Pages that are never measured.
Consent is not the only control. These paths carry a confidential identifier in the URL, so the tag does not load on them whatever you answered, and they send Referrer-Policy: no-referrer so the URL cannot follow you to the next page. Where a route is measured, the value reported is drawn from a closed list of public paths — never from the address bar.
| Path | Why |
|---|---|
| /evidence/pack | Carries a trade identifier in the path |
| /verify/pack | Carries a trade identifier in the path |
| /verify/hash | Carries an artefact hash in the path |
| /verify/keys | Carries a signer identifier in the path |
| /verify/route | Routes into the three above |
| /studio | Editorial back office; no longer served in production |
| /buyer | Reserved for the buyer application |
| /ops | Reserved for the operations application |
| /api | Machine endpoints; no page is rendered |
Outside origins your browser may contact.
The content-security policy on every page is the boundary. Anything not on this list is blocked by the browser before a request is made.
| Origin | Purpose | When |
|---|---|---|
| googletagmanager.com | Serves the analytics tag | Never today — no measurement ID is configured |
| google-analytics.com | Receives analytics hits | After you accept, and only once the tag is configured |
| cdn.sanity.io | Images published through the content system | When a page renders one |
| ingest.sentry.io | Error reports | Never today — the browser-side reporter is not wired up; reports travel from the server |
| va.vercel-scripts.com, vitals.vercel-insights.com | Vercel audience and performance measurement | Never today — both components are unmounted |
| vercel.live | Vercel preview toolbar | Preview deployments only |
| api.resend.com | Email delivery | Never from your browser — the form posts to this site and the server sends the email |
Typefaces are served from this origin. No advertising pixel, session recorder, chat widget or social embed is loaded at all — none is on the policy, so none can be.
Asking us about any of this.
Write to privacy@importable.io. That is the same address as the privacy notice, and it reaches a named person. You can withdraw consent at any time without writing to anyone — the control is in the footer of every page, and it takes effect on the next request.