Cookie Policy
Last Updated: September 11, 2026
This policy explains what we store in your browser, why, and how to change it. It covers cookies and the equivalent technologies — local storage, session storage and pixels. It sits alongside our Privacy Policy, which covers everything else we do with personal data.
1. How consent works here
On your first visit you are asked to choose between three categories: necessary (always on, and required for the site to function), analytics, and marketing. Nothing in the analytics or marketing categories loads until you opt in — the scripts are not merely inert, they are not fetched at all, because Cloudflare Zaraz gates the loading itself. PostHog is loaded directly but starts with capturing switched off and only begins once analytics consent is granted.
Your choice is stored in your browser under the key c15t-consent and mirrored to the zaraz-consent cookie. It is also recorded on our servers with a timestamp and version, so we can evidence when consent was given. Choices expire after 12 months, at which point you are asked again.
To change or withdraw consent at any time, use the round cookie-preferences button in the bottom-left corner of every page, which reopens the banner with your current choices. Turning analytics off takes effect immediately in the current tab, without a page reload.
2. Strictly necessary
These are set without consent because the site cannot work without them. They are not used for analytics or advertising.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
| __Host-auth_session (also __Secure-auth_session, auth_session) | First party | Your signed-in session. The value is encrypted with AES-GCM and is HttpOnly, so page scripts cannot read it. Without it you cannot stay signed in. | 24 hours |
| __Host-csrf_token (also __Secure-csrf_token, csrf_token) | First party | Cross-site request forgery protection. The value is echoed back in a request header so the server can confirm the two match. It is deliberately readable by our own scripts, which is how the double-submit pattern works. | 1 hour |
| auth_state | First party | Holds the OAuth state and PKCE verifier for the few seconds between starting a sign-in and returning from the identity provider. Deleted as soon as sign-in completes. | 10 minutes |
| zaraz-consent | First party (Cloudflare Zaraz) | Records your consent choices so Cloudflare Zaraz knows which analytics and advertising scripts it is allowed to load. Kept in step with the c15t-consent value described below. | 1 year |
| Cloudflare security cookies (for example __cf_bm) | First party, set by Cloudflare | Bot management and abuse prevention on our edge network, including the Turnstile challenge on public forms. Set by our infrastructure provider as part of protecting the site. | Typically 30 minutes to 1 year, depending on the cookie |
3. Analytics — consent required
Set only after you accept the analytics category. This includes _ab_id, our A/B test enrolment cookie, which was previously listed as a functional cookie and set on every visit. It is not any more: it is written only with analytics consent, and removed if you decline or withdraw.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
| _ab_id | First party | A random identifier that keeps you in the same variant of an A/B test between visits, so the site does not change shape under you mid-session. It is not linked to your account, is not shared with any third party, and carries no information about you. It is written only after you grant analytics consent; if you decline, or later withdraw, no cookie is set and any existing one is deleted — you simply stay on the default variant and are not counted in any experiment. | 1 year |
| ph_*_posthog | Third party (PostHog) | PostHog session identifier and feature-flag state. The exact name includes our project key. Written only after you grant analytics consent, and cleared when you sign out. | 1 year |
| _ga, _ga_* | Third party (Google Analytics 4) | Google Analytics client and session identifiers. Loaded through Cloudflare Zaraz. | Up to 2 years |
| _clck, _clsk | Third party (Microsoft Clarity) | Microsoft Clarity user and session identifiers, used for heatmaps and session replay. | _clck 1 year, _clsk 1 day |
| Cloudflare Zaraz session cookie | First party (Cloudflare Zaraz) | Session measurement for the analytics tools Zaraz manages. | 30 minutes |
4. Marketing — consent required
Set only after you accept the marketing category.
| Name | Set by | Purpose | Duration |
|---|---|---|---|
| Google Ads conversion cookies | Third party (Google) | Attribute a signup or purchase to an advertising click. | Up to 90 days |
| Google AdSense advertising cookies | Third party (Google) | Ad selection and frequency capping on pages that carry advertising. | Varies by cookie, up to 2 years |
5. Counting page views without a cookie
We count page views on our own servers without setting a cookie or reading anything from your device. For each request, our edge server computes a hash from a server-side secret, the current date in UTC, your IP address, your browser's User-Agent and its language preference, and sends that hash with the page path, referrer and country to PostHog. The hash changes every day and the secret never leaves our servers, so it cannot be reversed to an IP address or used to recognise you tomorrow. No profile is built from these events and they are never linked to an account, even if you later sign in.
Because this stores nothing on your device, it is outside the scope of the consent banner. It relies on our legitimate interest in measuring our own audience. Note that the request itself carries your IP address to PostHog's EU ingest endpoint, where it is used to derive an approximate country and region and is not retained against a profile.
6. Local storage
Local storage keeps data on your device and, unless a specific feature says otherwise, none of it is transmitted to us. We use it for:
- Your choices: consent preferences (
c15t-consent), theme, dismissed prompts and banners, notification preferences. - Your place in the site: reading history, recently viewed items and entities, recent searches, saved tool inputs and scores, in-progress checklists, and the handoff of results between tools.
- Feature state: workspace selection in the ArchiMate and SplitCause editors, Command Center table layouts, tech-tree progress, and game state for Runway.
- Sign-up attribution: the campaign parameters present when you first arrived, so we can attribute a later signup. These are read when you create an account.
- Push notifications: the device token issued if you enable them.
- Analytics SDK state: PostHog's distinct ID and feature-flag cache under keys prefixed
ph_, written only after analytics consent and cleared on sign-out. - Reading-session grouping:
taoc_session_idandtaoc_session_last— a random identifier that groups the pages you read in one sitting, so a visit counts once rather than once per page. It rotates after 30 minutes of inactivity, contains nothing about you, and is not linked to your account unless you are signed in.
Clearing site data in your browser removes all of it. Doing so signs you out and resets your preferences, but does not delete anything saved to your account on our servers.
7. Browser-level controls
Every major browser lets you block or delete cookies, in settings or through private browsing. Be aware that blocking the strictly necessary cookies above will prevent you from signing in and will cause form submissions to be rejected. You can also install the Google Analytics Opt-out Browser Add-on.
We do not currently act automatically on Do Not Track or Global Privacy Control browser signals. The consent banner is the control that works.
8. Changes and contact
When we add or remove a cookie, this page is updated and the date at the top changes. Questions about anything on it: privacy@theartofcto.com.