Cookie policy

Optional analytics: _ga and _ga_3RWJ6T90M1

Provider: Google Analytics, stored as first-party cookies on gdprfix.org. Purpose: distinguish browsers and sessions for aggregate website measurement after you consent. Our tag sets a maximum lifetime of 180 days without extending it on each visit. These are not essential to a scan or account. Rejecting optional cookies keeps the tag blocked; withdrawing consent removes these cookies. Google may change its implementation, so your browser shows the actual stored values and expiry dates.

Guest reports: gf_guest

Provider: GDPRFix, on the hostname you are using. Purpose: links your browser to the private scans you request without an account. Set when you request a scan, not simply when you read the homepage. Lifetime: up to 30 days. It is HTTP-only, SameSite=Lax and marked Secure in production. Its purpose is access to your requested reports, not advertising or cross-site tracking.

Account sign-in: gf_session

Provider: GDPRFix. Purpose: authenticates your account after a valid one-time sign-in link. Lifetime: up to seven days; signing out removes it and invalidates the session. It is HTTP-only, SameSite=Lax and marked Secure in production. Authentication tokens are stored as hashes on the server.

Google reCAPTCHA for scans and contact messages

Where enabled, selecting Load security check loads Google reCAPTCHA. It can use Google cookies, including a security cookie named _GRECAPTCHA, and process browser and network information to assess whether the interaction is automated. We do not load it simply because you visit a page. The form links to Google’s privacy notice and terms before loading the check. You can email us directly instead. Google controls its cookie lifetimes and may use existing Google cookies; your browser’s site-data settings show the cookies actually stored.

Google privacy notice ↗

Accept, reject or change your choice

The cookie notice offers equally accessible Accept all cookies and Reject optional cookies buttons. Until you accept, we do not load Google Analytics or send it measurement requests. Cookie settings is available at the bottom of every page. Rejecting after an earlier acceptance stops our analytics and removes its first-party cookies. Your choice is stored in the essential gf_cookie_consent cookie for 180 days; it records accepted or rejected, without a user identifier.

Removing cookies

You can remove or block cookies in your browser’s site-data settings. Removing gf_guest may prevent you accessing guest reports; removing gf_session signs you out. Deleting a browser cookie does not by itself delete the server-side report or account. Use the privacy contact for a data-deletion request.

Your currency preference

The sessionStorage entry gdprfix-display-currency remembers the display currency you explicitly select for this browser tab. It lasts for the tab session and is not used for advertising or analytics. Automatic currency display can use a country code supplied by our hosting provider without setting a separate tracking cookie.

Storage and other services

We do not use localStorage or sessionStorage for advertising or analytics. The report interface may use browser storage to remember viewed tabs and the currency you request. The sessionStorage entry gdprfix-pending-url keeps the website address you entered while you sign in, and is removed after a successful scan submission or when the tab session ends. Those preferences and the submitted address do not go to Google. Development tooling or browser extensions can add their own activity and are not part of the production application. When enabled, checkout takes place on Stripe’s website under its own cookie disclosures. Websites being scanned run in separate worker browser sessions; their cookies are not installed in your browser.

Testing our own website

Our compliance page publishes a dated self-scan and its scope. A scan is a snapshot, not certification. We also check behaviour before a cookie choice, after rejection and after consent withdrawal when changing our analytics implementation.