Cookie Policy

Nothing is set until you choose. Google Tag Manager is not loaded, and no request is made to Google, until you press Accept on the banner. Declining is exactly as easy, and is remembered.

What is stored before you choose

One thing, and it is not a cookie:

Name	Type	What it is
md-consent	Browser local storage	Your answer to the banner, so it is not asked again. First-party, never sent anywhere.
md-theme	Browser local storage	Whether you chose light or dark, so the page does not flash the wrong one. Absent means “follow your device”. First-party, never sent anywhere.
md-attribution	Browser session storage	The page you arrived on and any campaign tags in the address, so a purchase can be credited to what caused it. No identifier of any kind, never sent to a third party, and gone when you close the tab.

The consent value is what makes the banner stop appearing; it is stored whichever way you answer, including when you decline.

md-attribution is deliberately session storage rather than a cookie. The usual version of this is a cookie that lasts months, so somebody who reads a comparison page today and buys next week is still credited to it. That is more useful to us and it is storage on your device that nothing you asked for requires — and a site that gates analytics behind a banner and then quietly writes a marketing cookie is being clever rather than careful. So it lasts one visit, and we accept losing the rest.

What is set if you accept

Name	Set by	Purpose	Lifetime
_ga	Google Analytics	Distinguishes one browser from another	2 years
_ga_<id>	Google Analytics	Keeps session state	2 years

We use Consent Mode v2 with defaults set to denied before the container loads, so the “modelled” behaviour some sites rely on is not used here — if you decline, nothing is sent, including a signal that you declined.

What is never set

No advertising cookies. No remarketing pixels. No social tracking. No cross-site identifiers. There is no third-party script on this site other than Google Tag Manager after consent, and Cloudflare Turnstile on the contact forms.

Turnstile

The contact and early-access forms use Cloudflare Turnstile to keep bots out. It is a security control on a form you are deliberately submitting rather than analytics, so it is not behind the consent banner. It sets no advertising identifier and does not track you across sites.

Changing your mind

Clear this site’s storage in your browser and the banner will ask again. In Chrome and Edge that is under Settings → Privacy → Third-party cookies → See all site data; in Firefox and Safari, under the site’s padlock menu.

The product

This policy is about this website. The MailDock software you install sets its own session cookie for the admin console and webmail on your domain, and no analytics of any kind.