Cookie Policy

Effective date: [Date]

Last updated: [Date]

This Cookie Policy explains what this website stores in your browser, why, and how you can control it. It is part of our Privacy Policy, which explains how we handle personal information in general. The website is operated by [Legal name of the operator] ("we", "us" or "our"). Contact: privacy@example.com.

Summary

  • No cookies on an ordinary visit. When you read pages without signing in, we set no cookies until you make a choice in the cookie banner.
  • No analytics, advertising or tracking. We do not use analytics cookies, advertising cookies, social media pixels or any other cross-site tracking.
  • What we do use is limited to what the website needs to work: a session cookie when you sign in or use a form that needs one, a small cookie that says you are signed in, and a service worker that keeps copies of public pages in your browser so they open faster. We also remember the choices you make in the cookie banner and under our videos.
  • YouTube videos load only when you choose. Videos are shown as a placeholder with a locally stored preview image. Nothing is requested from Google until you press play, or until you choose to always allow YouTube videos on this website. The player then comes from youtube-nocookie.com.
  • You are in control. You can change your choice at any time through "Cookie settings" at the bottom of every page, through your browser settings, or by clearing this website's data.

1. What cookies and similar technologies are

  • Cookies are small text files that a website asks your browser to store and send back with later requests. "First-party" cookies are set by the website you are visiting. "Third-party" cookies are set by another service whose content appears on the page.
  • Session cookies are deleted when you close your browser. Persistent cookies stay until they expire or you delete them.
  • Local storage and session storage let a website keep small pieces of information in your browser. Unlike cookies, they are not sent to the server with each request. Local storage stays until it is deleted, and session storage ends when you close the tab.
  • IndexedDB is a browser database that some embedded services use for the same purpose.
  • A service worker is a small script that a website can register in your browser. It runs in the background and can keep copies of pages in the browser's Cache Storage, so that pages you have already seen open without waiting for the network.

In this policy, "cookies" covers all of these technologies unless we say otherwise.

2. How we use them

This website runs on Exponential, an open-source content management system. What follows is the complete list of what the website stores in your browser, grouped by purpose. We checked it against what the website actually does, both in the browser and in its code.

2.1 Strictly necessary

These are needed to provide the website and the services you ask for, such as signing in, sending a form or loading pages. They do not track you, and we do not use them for any other purpose.

  • eZSESSID (cookie)
    • Purpose: keeps your session, so the website knows you are signed in from one page to the next. It also carries the steps of signing in, including two-step verification while it is pending, the registration process, and the security token that protects signed-in users' forms against forged requests from other websites. The token itself stays on our server.
    • Provider: this website (first party).
    • Duration: until you close your browser. On our server, an inactive session ends automatically.
    • When it is set: only when it is needed, for example when you open the sign-in or registration page or sign in. Reading public pages does not set it.
    • Security: it cannot be read by scripts on the page (HttpOnly), it is only sent over encrypted connections (Secure), and it is not sent with requests started by other websites (SameSite=Lax).
  • is_logged_in (cookie)
    • Purpose: tells our page cache and the service worker that the person using this browser is signed in. Shared, cached copies of pages are then never shown to you, and your personal pages are never stored for anyone else. Its value is simply "true" and it contains no identifier.
    • Provider: this website (first party).
    • Duration: until you sign out or close your browser.
  • Service worker (/index.js) and its page cache (exp-nav-v4) (service worker and Cache Storage)
    • Purpose: makes pages you have already visited open immediately, by keeping a copy of each public page in your browser and refreshing it in the background. It only handles public pages of this website. It never stores or serves pages while you are signed in, and never touches the administration area, the sign-in pages or our programming interfaces. It deletes a stored copy when the page is removed or becomes private.
    • Provider: this website (first party). The copies stay in your browser and are never sent anywhere.
    • Duration: the service worker stays registered until you remove it or we switch it off. Stored pages are replaced each time you visit them and are all discarded when we release a new version of the cache. Your browser may also remove them when it needs space.
    • What it contains: copies of public web pages only, with no identifier and nothing about you.
  • ng-cc-consent (cookie)
    • Purpose: keeps your choice in the cookie banner, so the banner does not open on every page. Its value is "v1.rejected" if you chose "Reject all" or saved your settings with YouTube switched off, and "v1.youtube" if you chose "Accept all" or saved them with YouTube switched on. "v1" is the version of this policy's choices: when we change them, the banner asks you again.
    • Provider: this website (first party). It is set by the page's script only after you choose, and our server does not use it.
    • Duration: 6 months (180 days). The banner then asks again.
    • Security: it is only sent over encrypted connections (Secure) and not with requests started by other websites (SameSite=Lax). Scripts on the page can read it, because the banner needs it.

Our page cache on the server also tells signed-in and anonymous visitors apart using only the session cookie above. It does not set any cookie of its own.

Why no consent is needed for these. The ePrivacy rules in the EU and EEA (Article 5(3) of the ePrivacy Directive as implemented nationally), the UK Privacy and Electronic Communications Regulations (PECR, regulation 6(4)) and, in Germany, § 25(2) no. 2 of the Telecommunications Digital Services Data Protection Act (TDDDG) exempt storage that is strictly necessary to provide a service the user has explicitly asked for. Signing in, staying signed in, submitting a form securely, getting the pages you request without being shown someone else's, and having the choice you made in the cookie banner respected are such services. The service worker stores only copies of public pages you have already requested, contains no identifier, never leaves your device and works the same way as your browser's own cache. If you prefer not to have it, you can remove it at any time (see Section 3).

2.2 Preferences

These remember choices you have made, so we do not have to ask again.

  • exp-youtube-always (local storage)
    • Purpose: remembers that YouTube videos may load as soon as a page opens, without an extra click. It is set when you tick "Always allow YouTube videos on this site" under a video, choose "Accept all" in the cookie banner, or switch on "Embedded videos (YouTube)" in its settings. These are one and the same choice, which you can change in either place.
    • Provider: this website (first party). It is not a cookie and is never sent to our server.
    • Duration: until you choose "Stop loading YouTube automatically" under any video, choose "Reject all" or switch YouTube off in the cookie settings, or clear this website's data.
  • exp-admin4-theme (local storage)
    • Purpose: remembers whether the administration interface should open in dark or light mode. It is set only if you follow the "open the admin in dark or light mode" link on our product tour page.
    • Provider: this website (first party).
    • Duration: until you clear this website's data.

Earlier versions of the cookie banner stored the cookies ng-cc-accepted, ng-cc-analytics and ng-cc-marketing. They are deleted on your next visit, and the banner asks you once more.

2.3 Embedded content from YouTube

Some pages include videos hosted on YouTube, a service of Google. We embed them in a way that keeps Google out of your visit until you decide otherwise.

  • Before you choose: each video is shown as a placeholder with a preview image stored on our own server, a play button and a note that the video comes from YouTube. Your browser does not contact Google, and no Google cookies or other storage are set. Without JavaScript, the placeholder is a plain link to the video on youtube.com.
  • When you press play: the player is loaded from www.youtube-nocookie.com, YouTube's privacy-enhanced mode. From then on, your browser connects directly to Google's servers, including youtube-nocookie.com, ytimg.com, ggpht.com, google.com, gstatic.com and googleapis.com. Google receives your IP address, information about your browser and device, and the address of the page.
  • What Google may store: in our checks, the player stored items in its own local storage and IndexedDB (for example "ytidb::LAST_RESULT_ENTRY_KEY", "yt-icons-last-purged" and "YtIdbMeta") and set no cookies. Google decides what its player stores and may change it. It may set cookies, for example if you click through to youtube.com or are signed in to a Google account, and may link the information to your account. Current browsers keep this storage separate for each website you visit.
  • "Always allow YouTube videos on this site": if you tick this box, or choose "Accept all" in the cookie banner, we remember your choice in your browser (exp-youtube-always above), and videos on this website then load from youtube-nocookie.com as soon as a page opens. You can withdraw this at any time with "Stop loading YouTube automatically" under any video, or with "Reject all" in the cookie settings. The players then return to placeholders. Even with this switched off, each video still plays when you press its own play button.
  • Google's responsibility: Google processes this information under its own privacy policy (https://policies.google.com/privacy) and cookie information (https://policies.google.com/technologies/cookies). We do not receive any personal information about you from Google through the player, and we do not use it for advertising.

Social media icons on this website are plain links. Nothing is sent to the social network unless you click them.

2.4 What we do not use

  • No analytics: we do not measure your visits with analytics cookies or scripts, our own or anyone else's.
  • No advertising or marketing cookies, and no retargeting.
  • No social media pixels or social plug-ins that load before you click.
  • No cross-site tracking or fingerprinting, and we do not sell or share personal information through cookies.
  • No third-party fonts or maps on ordinary pages: our fonts are served from our own server. Map services are not loaded on any page we currently publish.

We checked this by loading the website in a fresh browser and recording every cookie, storage item and outside connection, before and after each choice in the banner.

3. Your choices

  • The cookie banner: on your first visit, before anything is stored, the banner offers "Reject all" and "Accept all" side by side, and "Settings". "Reject all" is as easy as "Accept all". Under "Settings" you see two categories: "Strictly necessary", which is always on because the website cannot work without it, and "Embedded videos (YouTube)", which you can switch on or off before you choose "Save my choice". The only thing "Accept all" adds is that YouTube videos load as soon as a page opens. Your choice is kept for 6 months in the ng-cc-consent cookie.
  • Changing your choice: you can reopen the banner at any time with "Cookie settings" at the bottom of every page, or here on this page. It opens with the settings unfolded; the close button or the Escape key closes it without changes. Without JavaScript the banner is not shown and nothing is stored.
  • YouTube: press play only for the videos you want to watch. To stop videos loading automatically, choose "Stop loading YouTube automatically" under any video.
  • Browser settings: all modern browsers let you see, block and delete cookies and other site data, and block third-party cookies. If you block all cookies, signing in and some forms will not work. Your browser's help pages explain how:
    • Chrome: https://support.google.com/chrome/answer/95647
    • Firefox: https://support.mozilla.org/kb/clear-cookies-and-site-data-firefox
    • Safari: https://support.apple.com/guide/safari/manage-cookies-sfri11471
    • Edge: https://support.microsoft.com/microsoft-edge/delete-cookies-in-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
  • Clearing this website's data: use your browser's option to clear site data for this website (in most browsers, the padlock or site information icon in the address bar, then "Cookies and site data"). This removes our cookies, local storage, the service worker and its stored pages at once.
  • Removing only the service worker or its cache: in Chrome and Edge, open Developer tools, then Application, then Service workers ("Unregister") or Cache storage. In Firefox, visit about:serviceworkers. The website works normally without it; pages simply come from the network every time.
  • Withdrawing consent: you can withdraw any consent as easily as you gave it, with effect for the future. This does not affect what was done before you withdrew it.
  • Global Privacy Control and Do Not Track: we honour Global Privacy Control (GPC) signals as described in Section 11 of our Privacy Policy. Because we do not sell or share personal information, and do not use cookies for targeted advertising, nothing on this website needs to change when your browser sends GPC. We do not respond to Do Not Track signals in a specific way, because there is no common standard for them, but we do not track you across websites in any case.

4. Regional information

  • European Union and European Economic Area: under the ePrivacy rules, we only store or read information on your device without consent where it is strictly necessary (Section 2.1). Everything else needs your consent: the YouTube player, and the preference items you set by your own choice. Where personal data is involved, the GDPR also applies. Our legal bases are our legitimate interest in running a secure and fast website (Article 6(1)(f)) and, for YouTube, your consent (Article 6(1)(a)). See Section 9.3 of our Privacy Policy.
  • United Kingdom: the same principles apply under PECR and the UK GDPR.
  • Germany: strictly necessary storage is based on § 25(2) no. 2 TDDDG, and all other storage on your consent under § 25(1) TDDDG.
  • Switzerland: we inform you about these technologies here, and you can refuse them as described in Section 3 (Article 45c of the Telecommunications Act and the revised Federal Act on Data Protection).
  • California and other US states: we do not sell or share personal information, including through cookies, and we do not use cookies for cross-context behavioural or targeted advertising. See Section 9.2 of our Privacy Policy for your rights under the CCPA and other state laws.
  • Other countries: where local law requires consent for cookies or similar technologies that are not strictly necessary (for example in Brazil, Canada, India, South Africa, Japan or South Korea), our click-to-load approach for YouTube and the choices in Section 3 apply in the same way.

5. Administrators and editors

People who edit this website or manage the server use areas that are not open to the public. These areas set a few more strictly necessary or preference items, which only those users receive:

  • a separate session cookie for the administration interface (named eZSESSID followed by a code; HttpOnly, Secure, SameSite=Lax, ends with the browser session);
  • small cookies and local storage entries that remember interface choices, such as the open tab, the content browser's columns and preview, the layout editor's view and the dark or light mode, plus a security token cookie used by the layout editor's text editor;
  • for server administrators, a sign-in cookie for the web server's control panel (Q_panel_token, 7 days) with matching session storage, local storage for its web shell, a session cookie for the database tool, and a cookie used only while the installation wizard runs;
  • for our technical team only, local storage for the debugging toolbar, shown only to approved network addresses.

None of these is used for analytics or advertising.

6. Changes to this policy

We will update this policy whenever we change what the website stores in your browser, and at least once every 12 months. When we do, we change the "Last updated" date at the top. If we add anything that needs your consent, we will ask for it before using it.

7. Contact

If you have questions about this Cookie Policy or our use of cookies, please contact us:

  • Operator: [Legal name of the operator], [Postal address]
  • Email: privacy@example.com

For more about how we handle your personal information and your rights, please read our Privacy Policy.

This cookie policy is a general template for this demonstration website and is not legal advice.