Cookies

Nothing is stored
until you choose.

This page lists every value importable.io can write to your device, what writes it, and how long it stays. Processing — what the forms collect, who receives it, how long it is kept — is on the privacy page.

§ 1

What is set today: nothing.

The analytics tag is not configured on this deployment. No measurement ID is set, so no Google script loads, the consent banner does not appear, and this site writes no cookie and no local-storage entry. There is nothing to accept and nothing to decline.

The rest of this page describes what happens when the tag is turned on, so the record exists before the switch is thrown rather than after.

§ 2

Everything this site can store.

NameKindPurposeLifetime
importable.consent.analytics.v1Local storage
This site
Holds your answer to the consent banner as the single word granted or denied. Without it the banner would ask again on every page load.
Strictly necessary
Until you clear site data
_gaCookie
Google Analytics
Tells one browser apart from another so a visit can be counted once.
Analytics — consent required
Set and expired by Google. Not set today
_ga_<stream>Cookie
Google Analytics
Holds session state for one measurement stream.
Analytics — consent required
Set and expired by Google. Not set today

The consent key is strictly necessary and is written whichever way you answer. It is the record of a choice you made, and it is the reason we do not ask again on the next page. It stays on your device; it is never sent to a server.

No analytics storage and no advertising storage is written before consent. That is enforced at the tag, not promised in prose — see the next section.

§ 3

The default is denied.

A short blocking script runs before the Google tag can load and sets Consent Mode v2 to these values. The browser executes it during parse, so the defaults are in place first. Ordering is guaranteed by the HTML specification, not by luck.

SignalDefaultMeaning
ad_storagedeniedAdvertising storage. Never granted by this site.
ad_user_datadeniedSending user data for advertising. Never granted by this site.
ad_personalizationdeniedPersonalised advertising. Never granted by this site.
analytics_storagedeniedThe only signal your answer changes.
functionality_storagegrantedStorage the page needs to work at all.
security_storagegrantedStorage used for abuse prevention.
wait_for_update500Milliseconds the tag waits for a stored answer before acting on the default.

Accepting updates one signal: analytics_storage. The three advertising signals stay denied whatever you answer, because this site runs no advertising and asks for no permission to.

§ 4

What each answer does.

YouThe site
AcceptWrites granted to local storage and updates analytics_storage. Google may then set the two cookies above and page views are counted.
DeclineWrites denied to local storage. Storage stays denied, no analytics cookie is set, and no event leaves your browser.
No answerThe default stands, which is denied. Nothing is written to your device at all until you answer.
§ 5

Changing your mind.

The footer of every page carries a control labelled Cookie choices. It reopens the banner so you can answer again, and withdrawing is one click, the same as giving. The control appears when the analytics tag is configured; with the tag off there is nothing to change, so it stays hidden.

Clearing site data in your browser removes the stored answer. The banner then treats you as a first-time visitor, and the default is denied.

§ 6

Pages that are never measured.

Consent is not the only control. These paths carry a confidential identifier in the URL, so the tag does not load on them whatever you answered, and they send Referrer-Policy: no-referrer so the URL cannot follow you to the next page. Where a route is measured, the value reported is drawn from a closed list of public paths — never from the address bar.

PathWhy
/evidence/packCarries a trade identifier in the path
/verify/packCarries a trade identifier in the path
/verify/hashCarries an artefact hash in the path
/verify/keysCarries a signer identifier in the path
/verify/routeRoutes into the three above
/studioEditorial back office; no longer served in production
/buyerReserved for the buyer application
/opsReserved for the operations application
/apiMachine endpoints; no page is rendered
§ 7

Outside origins your browser may contact.

The content-security policy on every page is the boundary. Anything not on this list is blocked by the browser before a request is made.

OriginPurposeWhen
googletagmanager.comServes the analytics tagNever today — no measurement ID is configured
google-analytics.comReceives analytics hitsAfter you accept, and only once the tag is configured
cdn.sanity.ioImages published through the content systemWhen a page renders one
ingest.sentry.ioError reportsNever today — the browser-side reporter is not wired up; reports travel from the server
va.vercel-scripts.com, vitals.vercel-insights.comVercel audience and performance measurementNever today — both components are unmounted
vercel.liveVercel preview toolbarPreview deployments only
api.resend.comEmail deliveryNever from your browser — the form posts to this site and the server sends the email

Typefaces are served from this origin. No advertising pixel, session recorder, chat widget or social embed is loaded at all — none is on the policy, so none can be.

§ 8

Asking us about any of this.

Write to privacy@importable.io. That is the same address as the privacy notice, and it reaches a named person. You can withdraw consent at any time without writing to anyone — the control is in the footer of every page, and it takes effect on the next request.

Privacy noticeContact