1. The short version
This website sets nothing. The application sets one cookie, to keep you signed in. The measurement tag sets two on your own domain, to tie a page view to the click that produced it. There are no advertising cookies, no third-party cookies and no tracking pixels anywhere in any of the three.
| Where | Cookie | Purpose | Life |
|---|---|---|---|
| utmcap.com | None | Nothing is stored in your browser at all | — |
| app.utmcap.com | utmcap_session | Keeps you signed in. Strictly necessary. | 30 days |
| Your tracking domain | _utmcap_cid | The click id, so a page view finds the click that paid for it | 1 or 30 days |
| Your tracking domain | _utmcap_src | Whether that id arrived by redirect or from the tag | 1 or 30 days |
2. This website
utmcap.com sets no cookies and writes nothing to local storage. It runs no analytics, embeds no trackers, and loads its typefaces, styles and scripts from its own origin, so opening a page here makes no request to any third party.
There is no consent banner because there is nothing to consent to. If that ever changes, the banner arrives before the cookie does.
3. The application
Signing in at app.utmcap.com sets one cookie, utmcap_session. It holds a signed session token and nothing else — no name, no email address, no account details. It is HttpOnly, so no JavaScript on the page can read it, and Secure, so it is never sent over an unencrypted connection. It lasts 30 days, and signing out deletes it immediately.
It is strictly necessary: without it there is no way to stay signed in between requests, so it is not one you can refuse and still use the application. It is not used for analytics or advertising, and it does not follow you to any other site.
4. The measurement tag
The tag you place on your own landing pages sets two cookies, on your domain rather than ours:
_utmcap_cid— the identifier of the click that brought the visitor to the page._utmcap_src— whether that identifier came from a redirect or from the tag itself. Kept beside the id rather than appended to it, so both stay readable.
Both are first-party, SameSite=Lax, and Secure on an HTTPS page. They live for one day when the visitor arrived through a tracking link, and 30 days when the tag set them itself — long enough for a conversion that happens days after the click to find the advertising that caused it.
Neither contains personal data. The click id is a random identifier that means something only inside your own account; it is not shared with anyone, not matched against any other site, and not used to build a profile. Attribution can also work without them, from the identifier in the URL — the cookies are what makes it survive a visitor moving between pages.
5. Consent, and whose job it is
On your landing pages, you are the controller and the cookie notice is yours to show. We cannot show it for you: it is your domain, your page and your decision about what else runs on it. Where consent is required in your visitors’ jurisdiction, place the tag so that it runs after that consent is given.
The relationship this creates between us is set out in the Data Processing Addendum, and what we do with the data in the Privacy Policy.
6. Refusing and clearing them
Every browser can block or delete cookies for a given site, usually under Settings → Privacy. Deleting utmcap_session signs you out of the application. Deleting the tag’s two cookies costs nothing except the attribution of a visit already in progress.
Blocking cookies for this website has no effect at all, because there are none to block.
Questions about any of this: [email protected]. To have data removed rather than blocked, see Data Deletion.