Cookie Policy

Cookies are small text files placed on your device when you visit a website. They let a site remember things about you between visits — from basic things like your theme preference to aggregate analytics about which pages people visit. Similar technologies such as local storage, tracking pixels, and device fingerprinting are treated the same as cookies in this policy.

Under the EU ePrivacy Directive, UK PECR, and the California CCPA/CPRA, we can only place non-essential cookies after you have given informed consent (or, in California, after we honour an opt-out signal).

We group cookies into four categories. You can turn each non-essential category on or off — independently — in the preferences panel.

• Strictly necessary — required for the site to function (session, security, remembering your consent choice). These cannot be turned off.
• Analytics — aggregate measurement of how visitors use the site, so we can improve it. We do not build personal profiles from analytics data.
• Marketing — measures advertising performance and supports remarketing. When disabled, we receive either no data, or only privacy-preserving aggregated signals from our ad partners (see §4).
• Preferences — remembers non-essential choices like theme and language across sessions.

Below is the current inventory. It is split into two tables — what is set on your device today, and what will be set when each third-party tag is enabled. If you spot a discrepancy, tell us at the email in §9 and we will correct it within 72 hours.

Active today

Dependent on third-party tags

None of the cookies below are set today. They are listed here so you know exactly what will be written if and when we enable each service — and only ever when the matching consent category is granted.

For Google services (Analytics 4, Ads) we use Consent Mode v2. Before any Google tag loads, our page sets defaults for four signals — ad_storage, ad_user_data, ad_personalization, analytics_storage — to denied. When you opt in, these flip to granted. When you opt out, no advertising or analytics cookies are written; Google may still receive privacy-preserving pings with ads_data_redaction turned on, which are aggregated and do not identify you.

We honour two browser-level privacy signals, symmetrically — whichever your browser sends, the effect is the same: analytics and marketing are off for this site without asking again.

Global Privacy Control (GPC). If your browser sends a GPC signal we treat it as a valid opt-out, as required by California Privacy Regulations §7025 (the 1 January 2026 regulations amendments make recognition of GPC mandatory for covered businesses). You can still open the preferences panel and opt in explicitly, which overrides the GPC signal only for this site.

Do Not Track (DNT). If your browser sends a DNT=1 header (Firefox, Brave, and some older browsers) we treat it as a valid automated objection under GDPR Article 21(5). This follows the Berlin Regional Court judgment of 25 January 2024 (VG Berlin 23 K 37/23), which held that DNT is a technical specification for exercising the right to object to processing based on legitimate interests. Chrome has removed DNT in favour of GPC; both are handled the same way here.

Visible confirmation. When we detect and honour either signal for the first time, a small toast at the top of the page explicitly tells you — so you know the signal was received and applied (CCPA 2026 regulations require visible processing of opt-out preference signals). The toast auto-dismisses after 12 seconds; a durable Signal active chip inside the cookie preferences modal header remains visible whenever the signal is asserted, so the acknowledgement is discoverable at any time.

You can change your choice at any time. There is a permanent Cookie preferences link in the footer of every page, alongside a Your Privacy Choices link that deep-links California residents directly to this control panel (CPRA §1798.135). You can also use the button below. Changes take effect immediately — analytics and advertising tags are granted or revoked on the spot, no reload needed.

If you previously accepted and want to reverse that decision, clicking Withdraw consent in the preferences modal records a distinct withdraw event in our consent audit log. Withdrawal does not affect the lawfulness of any processing that occurred before you withdrew (GDPR Art. 7(3)).

What withdrawal does and does not do. Revoking consent stops new analytics and advertising tags from firing, and we push a Google Consent Mode v2 denied update plus a Meta Pixel revoke immediately. It does not, however, delete cookies a third party may have already written on your device during an earlier consent — browser vendors don't let one site delete another domain's cookies. To remove those you can clear cookies for loomaru.com (and any listed third-party providers) via your browser settings — see §7.

Most browsers let you block or delete cookies through their settings. Blocking all cookies may break parts of the site that rely on strictly-necessary cookies (for example, logging in to the dashboard). Guides:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

When we add a new cookie category or a new provider, we bump the consent schema version, clear your stored choice, and re-prompt you. We will not quietly change what you consented to.

Changelog

• 2026-04-18 (v1.2) — Added Do Not Track (DNT) as a symmetric browser signal alongside GPC, per the Berlin Regional Court ruling of 25 Jan 2024 treating DNT as a valid GDPR Art. 21(5) objection. Added a durable "Signal active" chip in the Cookie preferences modal header. Extended the audit-log method enum with 'dnt' so GPC- and DNT-triggered rows are distinguishable. Banner layer-1 now names recipients (Google Analytics 4, Google Ads, Meta Pixel) directly.
• 2026-04-18 (v1.1) — Added visible Global Privacy Control acknowledgement (CPRA 1 Jan 2026 compliance), added "Your Privacy Choices" footer link, disclosed the consent audit record with a 36-month retention policy and automated purge, and added per-category recipient disclosure in the preferences modal.
• 2026-04-18 — First publication. Google Analytics 4, Google Ads, and Meta Pixel are listed as dependent — they are not loaded today.

Questions or corrections? Email vadim@loomaru.com. We respond within three business days.