Cookie Policy
Last updated: 2026-05-02
1. What are cookies?
Cookies are small text files stored by your browser. We also use similar technologies — localStorage and pixel tags — for consent preferences and conversion measurement.
The table below is the canonical inventory and is mirrored on our Privacy Policy. If you spot a discrepancy, the more recent Last updated date prevails.
2. Inventory
| Name | Purpose | Duration | Type |
|---|---|---|---|
a666_sess | HttpOnly JWT session cookie. Keeps you logged in. | 7 days | 1st-party · Essential |
a666_refresh | HttpOnly refresh token. Allows silent session renewal without re-login. | 30 days | 1st-party · Essential |
lead_dl | HttpOnly one-shot PDF download token (anti-abuse for the lead-magnet). | 60 seconds | 1st-party · Essential |
lead_event | Conversion event_id mirror used for client-side Meta Pixel deduplication. | 60 seconds | 1st-party · Essential |
a666_attr | First-touch attribution: stores the campaign parameters of the link you first arrived through — the utm_* values and, when the link came from an ad, the click identifier the platform appended to it (fbclid, gclid, msclkid and equivalents) — so that a later purchase can be credited to that link. Written by our own server, on this domain, before you answer the cookie banner. | 30 days | 1st-party · Attribution (set before consent) |
a666_cta | Records which block of the site you pressed to start a checkout — the button's internal name, such as home-featured — so that a paid order can be matched to it. Written in your browser at the moment of the click, before you answer the cookie banner. It holds that name and nothing else. | 30 minutes | 1st-party · Attribution (set before consent) |
a666_geo | Country flag worked out at the edge from your IP address. Its value is eu or xeu; the IP itself is not stored in it. It decides which default consent state the page starts in before you answer the banner. | 24 hours | 1st-party · Essential (consent gating) |
preview_bypass | Signed coming-soon preview gate cookie. Only set for staff/agency previews. | 7 days | 1st-party · Essential |
cf_clearance | Cloudflare challenge clearance — proves you passed the bot-protection challenge. | up to 30 minutes | 3rd-party (Cloudflare) · Essential |
__cf_bm | Cloudflare bot-management — rate-limits automated traffic. | 30 minutes | 3rd-party (Cloudflare) · Essential |
| Turnstile cookies | Cloudflare Turnstile — set during the bot-protection challenge on form submission. | session | 3rd-party (Cloudflare) · Essential |
a666_cookie_consent | Stored in your browser's localStorage (not a cookie sent to any server). Records your consent choices. | Until you clear it | 1st-party · Essential (localStorage) |
_ga | Google Analytics 4 — anonymized client identifier for traffic measurement. | 2 years | 1st-party · Analytics (opt-in) |
_ga_267DEDP3FZ | Google Analytics 4 — session state for our specific GA4 property (G-267DEDP3FZ). | 2 years | 1st-party · Analytics (opt-in) |
_fbp | Meta Pixel — browser identifier for ad attribution. | 90 days | 1st-party (set by Meta script) · Marketing (opt-in) |
_fbc | Meta Pixel — click identifier captured from fbclid URL parameter. | 90 days | 1st-party (set by Meta script) · Marketing (opt-in) |
3. Your choices
When you first visit the site, a cookie banner lets you accept all, reject all, or customise your preferences. Analytics and marketing cookies are only set after you opt in. For visitors in the European Economic Area and the United Kingdom, the default consent state under Google Consent Mode v2 is denied until consent is given.
Some first-party cookies are written before you answer the banner, and the table above marks each of them: a666_attr (the campaign link you arrived through, including the ad-click identifier inside it), a666_cta (which button you pressed), a666_geo (the eu / xeu flag that picks the default consent state) and _fbc (the ad-click identifier from the URL, in Meta's format). Each of these is set by this site rather than by a third-party tag, and each stays on this domain. One thing worth knowing about _fbc: once the Meta Pixel loads — after you opt in to marketing in the EEA, the UK and Switzerland, and on the first page view elsewhere unless you press "Reject" — it reads and refreshes that cookie, and the click identifier reaches Meta under the consent rule described in the table.
To change your preferences at any time:
4. Third-party cookies
Cloudflare, Google, and Meta may set additional cookies governed by their respective privacy policies. We recommend reviewing the Cloudflare Privacy Policy, Google Privacy Policy, and Meta Privacy Policy.
5. Contact
Questions? Email [email protected]. For GDPR rights requests use [email protected].