Cookie Policy
Last Updated: August 19, 2026
Most cookie policies describe cookies the site does not set, in language nobody reads, and end with an instruction to change your browser settings. This one is an inventory. It lists everything The DAS Board stores in your browser or records about your visit, what it is for, whether you can switch it off, and what happens if you do.
The short version
The application sets no cookies of its own. Your sign-in session is held in your browser's local storage, not in a cookie. The only cookies that can appear are Google Analytics', on our public marketing pages, and they stay switched off until you say yes. We also count page views in a way that needs no cookie and cannot recognise you on a later visit.
1. Why we have no cookies of our own
This is a design consequence rather than a virtue we chose to advertise. Authentication runs through Supabase using an authorization-code flow with PKCE, and the resulting session token is written to your browser's localStorage. A cookie would be sent to our server on every request; local storage is not, and is read only by the application code running in your own tab.
The practical differences worth knowing: the session stays in that browser on that device, it is cleared when you sign out, and clearing your browser's site data signs you out. Because it is not a cookie, it is not covered by the consent banner — it is strictly necessary for a product you have signed into, and there is no version of the product that works without it.
2. Google Analytics, and exactly how consent works
Our public marketing pages load Google Analytics 4 (property G-86LF96ZJ62). It is worth being precise about the sequence, because "we only set analytics cookies after you consent" is a sentence many sites print while doing something else:
- The Google tag script is fetched on every page load, before you have chosen anything. That request tells Google your IP address and that a browser loaded a page on our domain.
- Before that script can do anything, the page sets Google Consent Mode v2 defaults to denied for analytics storage, advertising storage, advertising user data, and advertising personalisation.
- Denied means no analytics cookie is written and no measurement is transmitted. Google’s documented behaviour in this state is to send at most a cookieless signal.
- If you accept in the banner, we send Google a consent update and the normal analytics cookies (_ga and friends) begin to be set. If you reject, nothing changes and no cookie appears.
- We also enable IP anonymisation on the tag.
We would rather tell you the script loads first than claim it does not. If you want the request never to happen at all, a content blocker will stop it and nothing on the site will break.
3. Our own page counter, which runs either way
Separately from Google, we keep a first-party count of page views. It is deliberately built so it does not need consent, because it cannot identify anyone:
| What it records | What it does not |
|---|---|
| The page you viewed and the page you arrived from | No visitor identifier — the field exists in the table and is always written as empty |
| Campaign tags on the URL, if you arrived from one of our links | No cookie, of any kind |
| Your device category (desktop, tablet, or mobile) and your browser’s user-agent string | No way to recognise you on a later visit, or to link two visits together |
| Your country, from the hosting network’s geolocation header | Not your IP address. A fallback that stored the raw address when the country header was absent was removed on 19 August 2026. |
| A per-tab identifier so a sequence of pages reads as one visit | That identifier lives in sessionStorage and is destroyed when you close the tab |
Requests from bots and crawlers are discarded rather than counted, and the endpoint is rate-limited per address.
4. Everything stored in your browser
| What | Where | How long | Can you refuse it? |
|---|---|---|---|
| Sign-in session token | localStorage | Until you sign out or clear site data | No — the product cannot work without it, and it only exists once you sign in |
| Your language choice | localStorage | Until you change or clear it | Yes, by clearing site data; the site then defaults to English |
| Your cookie decision and the date you made it | localStorage | Twelve months, then we ask again | Clearing it makes the banner reappear |
| Per-visit tab identifier | sessionStorage | Until the tab closes, or 30 minutes idle | No, but it identifies nothing and leaves no trace |
| Google Analytics cookies (_ga, _ga_*) | Cookies, set by Google | Up to two years, per Google’s defaults | Yes — they are never set unless you accept |
5. What we do not do
- No advertising, retargeting, or conversion-tracking pixels. No Meta pixel, no LinkedIn Insight tag, no Google Ads remarketing tag.
- No third-party web fonts. The interface renders in your system font, so no font request goes to Google or anyone else. Four unused Google Fonts connection hints were removed from our HTML on 19 August 2026 for exactly this reason.
- No session recording on the public marketing pages.
- No selling of personal information, and no sharing of it for cross-context behavioural advertising.
6. Session replay, which is not a cookie but belongs here anyway
Once you are signed in, our error-tracking provider, Sentry, records a replay of the interface for roughly one session in ten, and for every session in which an error occurs. It is used to reproduce faults. Sentry's replay masks text content and blocks media by default, and the error reports themselves are stripped of tokens, passwords, email addresses, and telephone numbers before they leave our servers.
This is not a cookie and is not covered by the banner, which is precisely why it is named here rather than left out: in a product that displays what people are paid, a recording of the screen is something you are entitled to know about. Section 2 of the Privacy Policy covers it as well.
7. Changing your mind
Open the banner's Your Privacy Rights panel and change any switch. If you have already made a choice and the banner is gone, clearing this site's data in your browser brings it back. We re-ask everyone every twelve months regardless.
Questions about anything on this page: privacy@thedasboard.com. Google's own description of what its analytics cookies do is at policies.google.com/technologies/cookies.