Cookie Policy

1. What cookies are

A cookie is a small text file a website asks your browser to store and send back on later requests. Cookies are how a site remembers that you are signed in between one page and the next.

Related technologies do similar jobs by different means. localStorage and sessionStorage keep values in your browser but are never sent to a server. They are not cookies, and we list what we use anyway, because the distinction should not be a way to avoid telling you.

This policy covers capybari.com — the marketing site you are reading now — and the signed-in application. It sits alongside the Privacy Policy, which explains what we do with personal data.

2. What the marketing site does

This marketing site sets no advertising cookies and loads no third-party fonts. There is one optional analytics tag, described below, and nothing else.

There is no tag manager, no advertising or remarketing pixel, no social media widget, no session recorder, no A/B testing script, no chat widget and no embedded video player.

Google Analytics — on from the moment you arrive. We would like to know which pages people find useful, and we use Google Analytics 4 for that. While the site is new it runs on every visit, and we are not currently asking first. We would rather tell you that plainly here than show you a banner that implies a choice we are not yet offering.

If you accept, Google Analytics sets _ga and _ga_G-40LWSGXP2R, which distinguish one browser from another so a returning visitor is not counted twice. They expire after two years and you can clear them at any time in your browser. We turn off Google Signals and ad personalisation, so the data is not used to build an advertising profile of you, and we do not upload customer lists. Google acts as our processor and receives your IP address, which GA4 discards after using it to derive an approximate location.

We said on this page that adding analytics would mean asking first, and for a period it did. It does not at the moment, and this paragraph is here so that the change is stated rather than quietly made. Consent will come back before the site is promoted anywhere; if that matters to you now, blocking googletagmanager.com in your browser stops the tag completely and nothing else on the site depends on it.

We do keep server-side request logs — URL, timestamp, status, referrer, user agent and a truncated IP address — for security and capacity. Those are logs on our own servers, not cookies in your browser. See the Privacy Policy for how long we keep them.

3. The two things the marketing site stores

The site has a light and dark theme. When you use the theme toggle, we save your choice so the next page does not flash the wrong theme at you.

That choice is stored as a value called capybari-theme in your browser's localStorage. It holds one word — the theme you picked. It is not a cookie, it is never sent to our servers, it contains no identifier, and it cannot be used to recognise you. If you never touch the toggle, nothing is stored and the site follows your operating system's preference.

Clearing site data in your browser removes it. Nothing breaks; the site goes back to following your system preference.

The second is only stored if you arrive through a campaign link — one carrying utm_source, utm_campaign or a similar tag, which is how we tell that an advertisement or a newsletter worked. Those labels are saved as capybari-campaign so that if you fill in a form three pages later, we can still tell where you came from.

It holds the labels we put in our own links and nothing else. No identifier, no browsing history, no record of the pages you read. It is never sent automatically — only as part of a form you choose to submit, and if you never submit one it never leaves your browser. Arrive without a campaign link and nothing is stored at all.

4. Cookies used by the signed-in application

Once you sign in, the application needs cookies to work. These are strictly necessary cookies: they are exempt from the consent requirement under the Privacy and Electronic Communications Regulations, because without them you cannot stay signed in. Cross-site request forgery is prevented with a request header rather than a second cookie, which is why only one appears below.

The table below lists them, verified against the running application.

All application cookies are set with the Secure and HttpOnly flags where the cookie is not read by client-side code, and with SameSite=Lax to limit cross-site use. The application sets no advertising cookies either.

5. How to control cookies

You are in charge of what your browser stores.

• Block or delete cookies in your browser settings. Every major browser lets you clear cookies and site data for one site or for all sites, and lets you block third-party cookies entirely.
• Use private browsing to have everything discarded when you close the window.
• Clear site data for capybari.com to remove the capybari-theme value along with any application cookies.

Blocking cookies on the marketing site costs you nothing except your saved theme preference. Blocking them on the signed-in application will stop you signing in, because there is no other way for the application to know it is still you.

Guidance for each browser is published by its maker: Chrome, Firefox, Safari, Edge.

Browser "do not track" and global privacy control signals are not needed here, since we do not track you across sites, but we will honour them if we ever add anything that would.

6. Changes to this policy

If we add anything that stores or reads data in your browser, we will update this page and the date at the top before it goes live. If the new item is not strictly necessary, we will ask for your consent first and give you a way to withdraw it.

7. Contact

Questions about this policy, or about anything you have found in your browser that is not listed here: privacy@capybari.com.