Cookie Policy
Last updated .
This website uses Google Analytics
If you accept analytics, Google may set cookies named _ga and
_ga_<id>. They can last up to two years and let Google recognise a
returning browser. They are not strictly necessary — the site works without them.
Your choice is stored by Auditry in your browser's localStorage under
auditry-analytics-consent. That preference is not a cookie and, unlike a
cookie, is not automatically attached to web requests. It contains only
granted or denied; we communicate the resulting consent state to
Google as described below.
This site still does without:
- advertising or retargeting pixels;
- embedded videos, maps, chat widgets, or hosted forms;
- fonts loaded from someone else's server — ours are served from our own.
The consent banner
On every page, our self-hosted ga-bootstrap.js runs first and sets advertising
and analytics storage to denied. Only then does the browser load Google's
gtag.js. Our self-hosted consent.js shows the choice on your first
visit and records Accept or Decline. The ordering is deliberate: Google sees the denied
default before its loader can run.
Before you accept, Google Analytics cannot read or write the _ga cookies, but
its Advanced Consent Mode may still send Google cookieless consent and page-measurement
pings. Accept permits analytics cookies and full measurement. Decline — or ignore the
banner — keeps analytics storage denied. You can change your choice at any time from the
"Cookie choices" link in the footer.
If you would prefer not to be counted, a browser-level tracking blocker will stop it, and you can email us at any time to ask what we hold. (We don't claim the "Do Not Track" header helps here — Google Analytics does not honour it.)
The app is different — slightly
When you sign in at auditry.app, our authentication provider sets strictly necessary cookies. Their only job is to keep you signed in and to protect the session from being hijacked. They are not used for tracking or advertising, and the service does not work without them — which is precisely the definition of "strictly necessary", and why they do not require consent.
What happened, in order
Google Analytics code was added on and the banner followed on . The site's own Content Security Policy blocked both inline controllers: the banner never appeared and Google Analytics never configured. That failure was privacy-safe, but the page's promise that a first-time visitor would see a choice was not true.
On we moved both controllers into external files permitted by that policy and added a build check that rejects future inline executable scripts. We are leaving the failure written down rather than quietly tidying it away. A cookie policy is only worth reading if it admits the times it was wrong.
Contact
Questions: contact@auditry.com.