Cookie policy

What we measure, and what we don't

This site runs Google Tag Manager. It's a loader: a small script from Google that fetches whichever measurement tags we've configured, so we can see how many people visit, which pages they read and where they arrived from. That's the whole reason it's here.

What it isn't here for: we don't sell your behaviour to anyone, we run no session recorder and no heatmap, and nothing on this site watches you move around a page. The only tags we have configured in it are Google Analytics ones.

What we can no longer tell you is that nothing advertising-shaped leaves the page. This section used to say we ran no advertising tags and built no advertising audiences. We still haven't added one — but Google Analytics has a feature that does something close to it on our behalf, switched on by default, and we only found out by going and looking. That's the next section, because it deserves its own heading rather than a clause in this one.

None of it is stored unless you say so. Every analytics cookie and every advertising signal on this page is behind the consent banner described further down. Decline and nothing is counted at all as things currently stand; ignore the banner and Google Tag Manager does not load in the first place. The section on the banner explains exactly what each state does, including the one request that still happens when you decline.

This page is about this website. Our SERP Traffic browser extension is separate software you install yourself; it sets no cookies, but it does store things in your own browser and it contacts a different company. The privacy policy describes it.

What actually gets stored

A security cookie from our host

Cloudflare serves and protects this site, and may set a cookie named __cf_bm to distinguish real visitors from bots. It lasts around 30 minutes, contains no information identifying you personally, and cannot be used to track you across other websites. Under privacy law this one counts as strictly necessary, so it needs no permission from you.

Analytics cookies from Google — only if you accept

If you accept, the measurement tags loaded through Google Tag Manager set cookies in your browser to tell one visit from the next — Google Analytics uses names beginning _ga, and they last up to two years. They record how the site is used, not who you are: we never send Google your name, your email or anything you type into the contact form.

Loading the tags also means your browser makes a request to Google's servers, which reveals your IP address to them, in the United States. That's a real cost and we're not going to bury it in a sentence about performance. It happens whichever button you press — see "the banner" below, which is where we say so properly rather than in a clause here.

One thing we store whatever you choose

Your answer itself, under the name daena:consent, in your browser's own storage. It records the word "granted" or "denied" and nothing else — no identifier, no date, nothing that could distinguish you from anyone else who clicked the same button. It never leaves your browser and we can't read it. Without it the banner would ask you again on every page, which is its own kind of rude.

Google Signals — the part that is advertising, not measurement

On 28 August 2026 we opened a real browser and checked every address a page on this site contacts. Two of them we couldn't account for: an image request to www.google.<country>/ads/ga-audiences and a connection to stats.g.doubleclick.net. The second one is Google's advertising domain, and neither is a plain pageview.

They come from Google Signals, a Google Analytics feature that is switched on by default for a new property. Where a visitor is signed in to a Google account that has ads personalisation turned on, it lets Google associate the visit with that account — which is what makes cross-device reporting and Google Ads remarketing audiences possible. We didn't add a pixel to do this; it arrived on inside the analytics we did add.

We'd rather write that plainly than let it sit behind the word "analytics". It is advertising data, this page told you for nine days that no such thing happened, and the sentence was wrong the whole time. Google Signals stays switched on, and is now behind the banner — we'd rather ask you than quietly measure less. Decline and it never runs; accept and it does, exactly as described here.

One accident of our own security policy is worth knowing, because it changes what this means for you specifically. Both requests were being refused by your browser until 28 August, blocked by the policy described further down. We've now allowed the pair for one Google country domain, www.google.ca — so if your Google account resolves to any other country domain, the audience request is still refused, and blocked is blocked whatever our intentions were. There is no version of that sentence that makes us look organised.

Opting out doesn't depend on us: Google's own My Ad Center controls ads personalisation across your account, and the blocking options at the foot of this page stop the requests from this site entirely.

Redesign preview handoff

The website redesign preview adds no cookies. When you choose “Request a quote”, it uses session storage under daena:redesign-enquiry to carry your website address, preview reference and findings to our contact form. The form reads and removes the saved handoff and rejects one older than an hour. If you never open the contact form, it remains until that browser tab’s session ends. The isolated proposal frame loads a stylesheet script from cdn.tailwindcss.com and fonts from Google Fonts; neither sets a cookie. It loads nothing from the website you submitted.

Internal design review

The site includes an internal review tool that our team uses to leave comments on the design. It only activates from a special link, and when it does it stores those comments in your own browser so they aren't lost. If you've never used that link, nothing is stored. Even then, it never leaves your browser except when we deliberately send it to ourselves.

The banner, and exactly what each button does

Since 31 August 2026 you're asked before analytics or advertising data is stored. Until you answer, Google Tag Manager does not load. If you decline, no analytics cookie is written, nothing is read back except your own saved answer, and no analytics identifier is sent — so nothing above can follow you between visits or between sites. Google Signals doesn't run, no advertising audience is built, and the _ga cookies are never created.

What still happens if you decline, said plainly: your browser downloads one file from Google. It's the tag manager itself — the loader — and downloading it reveals your IP address to Google the way requesting anything from any server does. No analytics or advertising tag then runs, nothing is written to your device, and no identifier is sent. We checked this in a real browser rather than assuming it, and we'd rather you heard it from us than found the request in the network tab after reading a page that implied there was nothing to find.

We've also set it up so that if Google's measurement does report an anonymous page view while you've declined, it carries no cookie, no identifier and no advertising data — Google calls these cookieless pings, and they exist so a site can count traffic without tracking anybody. As of 31 August 2026 our setup isn't sending them at all; if that changes, the sentence above is what governs, and this page will say when.

The distinction underneath all of this, in one sentence: the rule that makes a consent banner necessary is about storing things on your device and reading them back. After you decline, the only thing this site stores or reads back is that answer; the Google request itself stores and reads nothing. What the request does do is reveal your address to Google, which is why it's described here rather than treated as invisible. If you don't want even that, leave the banner unanswered or use the blocking options below.

This page used to explain why there was no banner at all: we operate from Canada, where the standard is clear notice rather than a click. That reasoning was thinner than it looked. Quebec's own privacy law asks for consent, the EU and UK ask for it before anything is stored rather than after, and the Google Signals discovery above meant we were sending advertising audience data on a page that told people we weren't. Asking is simpler than arguing about which rule applies to whom, so the banner is shown to everybody rather than to visitors from particular countries.

One more honest note: ignoring the banner is stricter than declining. Google Tag Manager does not load until you press a button, and we'll keep asking rather than taking silence as a yes. The site does not add a recurring consent control to the footer.

Which third parties a page contacts

Google is the only third party involved. If you haven't answered, no Google address is contacted. If you decline, one address — googletagmanager.com, for the loader described above, and nothing after it. If you accept, five — googletagmanager.com for the loader, google-analytics.com and analytics.google.com for the measurement itself, and www.google.ca plus stats.g.doubleclick.net for the Google Signals requests described above. Our typefaces used to come from Google Fonts as well; we moved those onto our own domain and that request is gone, so fonts, images, stylesheets and scripts all come from us.

Nothing else is permitted to run, and that isn't a promise — it's enforced. The site sends a Content Security Policy naming the handful of addresses a script may be fetched from, so a tag pointing anywhere else is refused by your browser rather than by our good intentions.

How to check we're telling the truth

Don't take our word for it, and this is the page where that instruction is worth following. Open your browser's developer tools, go to the Application or Storage tab, and look at the site data for this domain. Before you answer the banner you may find Cloudflare's security cookie but no daena:consent entry; after declining, that entry records only your answer; after accepting, the Google analytics cookies described above join it. The Network tab shows every address the page contacted: before you answer, filtering for "google" should find nothing; after declining, it should find the tag manager file and nothing else. If you find something this page doesn't account for, we'd genuinely like to know: info@daenadigital.com.

Blocking them anyway

Every browser lets you block or delete cookies in its settings, and most now have a setting or an extension that blocks analytics outright. Use it here if you want to — nothing on this site will break, and we'd rather have an honest page than a complete dataset. Blocking the Cloudflare cookie may mean you're occasionally asked to prove you're human.

If this changes

This page used to promise that if we ever added an advertising pixel we'd ask you before it loaded. What actually happened was a third thing neither of us planned for: a feature we didn't add switched itself on inside a tool we did, and the page sat here contradicting reality until somebody checked. Repeating the same promise now would be worth very little.

So here is the narrower one we can actually keep. We will not deliberately add an advertising pixel, a session recorder or anything that follows you off this site without saying so here on the same day. And we will keep opening a real browser and reading the network tab, because that is the only thing that would have caught the last one — a tag manager's own dashboard reports a blocked tag and a working tag identically, and reads exactly as reassuring in both cases.