Cookie Policy
Effective October 11, 2026 · UAIU Holdings Corp
The short version
ADAWCAG.org uses two strictly-necessary cookies and one local-storage entry for your consent choice. If you turn on “Marketing”, we also set one first-party cookie (_fbc) and our servers send hashed contact info and conversion events to Meta to measure our ads. If you arrive through a partner's referral link, we set a first-party adawcag_ref cookie holding only that partner's code. We do not use the Meta Pixel or any Meta browser tag, Google Analytics, session-replay, or any third-party tracking script. The Calendly booking widget — the only third-party script we load — is gated behind your “Functional” consent and won't load until you opt in.
The four categories on the preferences modal
| Category | What it covers | On by default? |
|---|---|---|
| Strictly necessary | Auth session JWT and CSRF token. Required to log in and submit forms securely. Cannot be turned off. | Always on |
| Functional | Loads the Calendly booking widget when you choose to schedule a call. No tracking pixels. | Off — opt-in |
| Analytics | Privacy-preserving page-view counts (HMAC-hashed IP, no fingerprint). No GA, no Pixel. | Off — opt-in |
| Marketing | Ad measurement with Meta, done from our servers — see “What gets sent to Meta” below. Sets the first-party _fbc cookie only when you arrive from a Meta ad link. No Meta Pixel or browser tag. | Off — opt-in |
Global Privacy Control (GPC)
We honor the Global Privacy Control browser signal. If your browser sends GPC (Brave, Firefox with the flag, DuckDuckGo, Privacy Badger), we automatically treat your visit as a deny-all opt-out: the banner never appears, Functional / Analytics / Marketing toggles are locked off in the preferences modal, and a notice explains why. Our servers also check the Sec-GPC request header and never send anything to Meta when it is present. This is required by the California CCPA/ CPRA, the Colorado Privacy Act, and the Connecticut Data Privacy Act.
Cookies we set
| Name | Type | Purpose | Lifespan |
|---|---|---|---|
session | Strictly necessary | HTTP-only, signed JWT used to keep you logged in. Without it you cannot use the dashboard. | 30 days, refreshed on use |
_fbc | Marketing (opt-in) | First-party cookie set by our own code — not by Meta — holding the ad click ID (fbclid) from a Meta ad link, in Meta's fb.1.<timestamp>.<click id> format. Only set if you allowed Marketing and GPC is off; deleted if you withdraw consent. Our servers include it in the events described below. | 90 days |
adawcag_ref | Referral (first-party) | Set only when you open a partner's referral link (?ref=). Holds that partner's code — nothing that identifies you — so that if you sign up, the referring partner is credited. Never sent to third parties. | 90 days |
csrf-token | Strictly necessary | Anti-CSRF token paired with the session cookie to prevent forged form submissions. | Session |
Both cookies have HttpOnly, Secure, and SameSite=Lax set. Neither carries marketing identifiers and neither is shared with third parties.
Local-storage entries
| Key | Purpose | Lifespan |
|---|---|---|
adawcag_consent_v2 | JSON record of your per-category cookie choices (necessary, functional, analytics, marketing) plus a flag for whether GPC was active. So we don't re-prompt you. | Until you clear it |
adawcag_consent_v1 | Mirror of the v2 analytics flag (“accepted” / “rejected”) for backward-compat with older code paths. Will be removed in a future release. | Until you clear it |
What gets sent when you accept analytics
If you accept, we record one privacy-preserving page-view row per route visit:
- Path you visited (e.g.
/en/pricing) and locale - Referrer (the previous page) — never the full session history
- Your User-Agent string (browser + OS)
- An HMAC-SHA256 hash of your IP address salted with our server-side
JWT_SECRET— the raw IP is never written to disk
That's it. No fingerprint, no canvas hash, no advertising ID.
What gets sent to Meta when you allow marketing
Only if you turned on “Marketing” and your browser does not send GPC, our servers send Meta (Meta Platforms, Inc.) a conversion event through Meta's Conversions API when you:
- create an account (
CompleteRegistration) - run a free scan from the home page (
Lead) - start a scan from your dashboard (
StartScan) - start a free trial (
StartTrial) and make your first payment after it (Purchase), including the plan's value
Each event can include:
- your email address and our internal account ID, hashed with SHA-256 before they leave our servers (and your phone number, hashed, if you gave it at checkout)
- your IP address and browser User-Agent string
- the Meta ad click ID from the
_fbccookie, if you arrived from a Meta ad - the page the event happened on
We use this only to measure and improve our ads on Meta. For the trial and first-payment events, we store your consent choice, click ID, IP address and User-Agent on your subscription record with our payment processor (Stripe) when you start checkout, so the payment event a week later reflects the choice you made then. Without consent we store only the fact that you said no. Meta's handling is governed by its own privacy policy.
What we do not use
- No Google Analytics or GA4
- No Meta Pixel, Meta SDK, or any Meta browser tag or script
- No third-party advertising or remarketing cookies
- No Hotjar, FullStory, LogRocket, or any session-replay tool
- No cross-domain identifiers
Change your mind
You can revisit your choice at any time:
Turning Marketing off deletes the _fbc cookie and stops further events to Meta. Or clear adawcag_consent_v2 and adawcag_consent_v1 from your browser's storage. To delete the session cookies, use your browser's “clear cookies for this site” option, or sign out from the dashboard.