Legal

Cookie Policy

Last updated: 21 September 2026Effective: 21 September 2026Version 1.0

In plain language

Our marketing site stores almost nothing. Until you press Accept in the banner, the only thing written to your browser is the record of your own choice.

If you accept, we load one privacy-friendly analytics tool and remember which campaign brought you here, for 30 days. That is the entire list.

No advertising cookies, no cross-site tracking, no data brokers, no fingerprinting. You can change your mind at any time, and the site works identically either way.

This summary is for orientation only. The numbered sections below are the binding text.

1.What this policy covers

This policy covers the marketing website at tracepath.dev and the documentation at docs.tracepath.dev. It also explains, in section 5, the strictly necessary cookies used by the application at app.tracepath.dev.

It uses “cookie” as shorthand for every technology that stores information on your device or reads information already stored there — HTTP cookies, localStorage, sessionStorage, and similar. The law does not distinguish between them, and neither do we.

How the resulting personal data is handled is described in the Privacy Policy.

2.The rule we apply

Article 5(3) of the ePrivacy Directive, as implemented in Poland by the Telecommunications Law, requires your prior informed consent before anything is stored on or read from your device — unless it is strictly necessary to provide a service you have explicitly requested, or is used solely to transmit a communication.

The European Data Protection Board has confirmed that this rule is technology-neutral: it applies to localStorage, to identifiers in URLs and to pixels, not only to HTTP cookies. We apply it that way. Nothing outside the strictly necessary category is written or read before you consent, and consent is a genuine choice — Decline is one click and costs you nothing.

3.Strictly necessary storage

These items are used without consent, because without them we could not remember your choice or keep the site secure and available.

Name	Type	Set by	Purpose	Duration
`tracepath-analytics-consent`	localStorage	TracePath	Records whether you accepted or declined analytics, so the banner stops asking and so nothing loads without your permission. Value is the single word `granted` or `denied`. Contains no identifier.	Until you clear your browser storage for this site.
`__cf_bm`	HTTP cookie	Cloudflare	Distinguishes human visitors from automated traffic, to protect the site from bots and abuse. Set by our CDN and security provider, not readable by us as an identifier.	About 30 minutes.
`cf_clearance`	HTTP cookie	Cloudflare	Records that a visitor has passed a security challenge, so the challenge is not repeated on every request. Only set if a challenge was presented.	Up to 1 year.

The Cloudflare cookies appear only when our security provider needs them. They are security measures for a service you requested, and under Article 5(3) they do not require consent. See Cloudflare’s own documentation for the authoritative description.

4.Analytics — consent required

We want to know which pages and articles are worth writing, which is the whole purpose of analytics here. Nothing in this category loads, and nothing is written to your browser, unless you press Accept in the banner.

Name	Type	Set by	Purpose	Duration
`tracepath-utms`	localStorage	TracePath	Remembers the `utm_source`, `utm_medium`, `utm_campaign`, `utm_term` and `utm_content` parameters from the link that brought you here, so we can tell which campaign or article led to a sign-up. No identifier, no browsing history.	30 days, then ignored and replaced.
`_ga`, `_ga_<id>`	HTTP cookies	Google Analytics 4	Aggregate usage statistics: which pages are viewed, in what order, from which referrer, on what kind of device. The IP address is truncated before storage. Only present if Google Analytics is enabled for this deployment.	Up to 2 years.
None	—	Plausible Analytics	Where we use Plausible instead of Google Analytics, it is cookieless by design: it stores nothing on your device and uses no cross-site identifier. It still only loads after you accept, because it is not strictly necessary.	Not applicable.

Note

We run at most one analytics tool at a time, and only when it is configured for the deployment you are visiting. If the banner appears and you decline, no analytics script is fetched at all — we do not load it in a “limited” mode.

Google Analytics and Plausible act as our processors. Their roles, locations and transfer mechanisms are set out on the subprocessors page.

5.The application at app.tracepath.dev

The logged-in application is a different matter: it cannot work at all without storing something. Everything it stores is strictly necessary to provide the service you have explicitly requested, so no banner is shown there.

What	Kind	Purpose	Duration
Sign-in session cookies	HTTP cookies	Set by the sign-in service that handles registration, sign-in, two-factor authentication and social sign-in. They keep the sign-in flow signed in and protect it against cross-site request forgery. These are HttpOnly and Secure, so page scripts cannot read them.	For the session, or until they expire or you sign out.
`AUTH_TOKEN`	Local storage	The API credential the dashboard sends on every request. It is held in your browser's local storage rather than in a cookie, which means it is readable by scripts running on the dashboard origin. Signing out removes it. We are aware this is weaker than an HttpOnly cookie and it is on our list to change.	Until you sign out or clear storage.
`USER_ORGANIZATIONS`, `IS_OPERATOR`	Local storage	Your organisation memberships and roles, cached so the dashboard can render its navigation before the first API response arrives.	Until you sign out or clear storage.
`CURRENT_PROJECT_ID`, sort, theme and timezone keys	Local storage	Interface preferences such as your last selected project, table sort order, light or dark theme and time zone, so the dashboard opens where you left it.	Until you clear storage.
`sidebar:state`	HTTP cookie	Whether the navigation sidebar is expanded or collapsed. Not HttpOnly — it is set by the page itself and holds no personal data.	7 days.
Cloudflare Turnstile	Set by Cloudflare	Bot protection during sign-up, where enabled. Storage is set by Cloudflare for the duration of the challenge.	Short-lived.

We do not run third-party analytics or advertising technology inside the application.

6.What we do not use

No advertising or retargeting cookies, and no advertising network pixels.
No cross-site or cross-device tracking, and no data sharing with data brokers.
No social media tracking pixels or embedded like buttons that phone home.
No device fingerprinting, canvas fingerprinting or other attempts to identify you without storage.
No session recording of visitors to our own marketing website.

7.Giving and withdrawing consent

On your first visit, a banner asks whether you accept analytics. Accept and Decline are equally prominent, and neither is preselected.
Declining is a complete answer. Nothing outside the strictly necessary category is loaded, and you are not asked again on that browser unless you clear storage.
To withdraw consent, delete the site data for tracepath.dev in your browser — this removes the tracepath-analytics-consent record, the tracepath-utms record and any analytics cookies in one action. The banner then reappears on your next visit and you can choose Decline.
Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.
We honour Global Privacy Control and Do Not Track signals. If your browser sends either one, we treat it as a decline: the banner is not shown, no analytics script is fetched, and we do not store the campaign-attribution record either. You do not have to do anything else.

8.Controlling storage in your browser

Every major browser lets you view, block and delete cookies and site storage, usually under Privacy or Site settings. Blocking the strictly necessary items will not break the marketing site, but it will make the consent banner reappear on every visit, and blocking cookies for app.tracepath.dev will prevent you from signing in.

You can also opt out of Google Analytics across all sites using the browser add-on Google publishes for that purpose.

9.Changes

If we add, remove or change what is stored on your device, we will update this page, change the date at the top, and — where the change requires fresh consent — ask again through the banner.

10.Contact

Questions about this policy, or a report that something is being stored that is not listed here: [email protected]. We treat an undisclosed storage item as a bug and will fix or document it.

More legal documents: Legal & trust centre.