GotAPal — Cookie Policy (DRAFT)

Effective date: [to set on launch]

GotAPal uses a small, deliberate set of cookies. We default to essential-only and ask before setting anything else. Here's the full list:

Cookies we set by default (you can't opt out — these run the site)

Name	Set by	Purpose	Lifetime
`__session`	GotAPal	Keeps you signed in across pages	14 days
`csrf`	GotAPal	Prevents forged form submissions (security)	Session
`consent`	GotAPal	Remembers your cookie choices so we don't keep asking	12 months
`cf_clearance`	Cloudflare	Anti-bot / anti-abuse protection	30 days

Cookies we set only if you say yes

Name	Set by	Purpose	Lifetime
`_ga`	Google Analytics 4	Distinguishes unique visitors	2 years
`_ga_[ID]`	Google Analytics 4	Records session state	2 years

GA4 helps us understand which pages are useful and which are confusing. It does not let us identify you individually. You can opt out per visit, or block GA permanently in your browser settings.

Cookies we don't use

Advertising / third-party tracking cookies — we don't run ad networks and we don't share data with them. We won't ever embed Facebook pixel, Google Ads remarketing, or similar without rewriting this policy and asking again.
Social sharing widgets that set cookies — we use simple share links instead.

Managing your cookies

Use the cookie banner that appears on first visit (and is always available via the "Cookie settings" link in the footer).
Use your browser's privacy settings to block or clear cookies.
Install a browser extension that controls cookies more granularly.

If you turn off cookies

The site keeps working but:

You'll be signed out and asked to log in again every time you visit.
Some form submissions may fail (the CSRF protection needs a cookie).
We can't tell which pages you find confusing, so improvements take longer.

Changes

We won't add new tracking cookies without changing this policy and re-asking your consent. Last reviewed: [date].

Questions

Email privacy@gotapal.com.

*Draft for review.*