Cookie Policy

All four cookies are set with the JavaScript document.cookie API using path=/;SameSite=Lax. Being precise about what that means, and what it doesn't:

• SameSite=Lax is set — this restricts the cookie from being sent on most cross-site requests, which is standard practice for first-party analytics cookies.
• The Secure flag is not currently set on these cookies. We state this plainly rather than assume or imply otherwise — if your site is served entirely over HTTPS (which we recommend, and which TLS/HTTPS is required for in most modern browser contexts anyway), the practical exposure is limited, but we are not claiming the flag is present when it verifiably is not in the snippet's code today.
• The HttpOnly flag is not set, and structurally cannot be for these specific cookies — they are set via client-side JavaScript (document.cookie) so the snippet can read them back on the next page load to recognize a returning visitor; a cookie set with HttpOnly is invisible to JavaScript entirely, which would break that mechanism. This is a real architectural constraint of client-side analytics snippets generally, not an oversight specific to Groager.

• They are not third-party advertising or ad-retargeting cookies — Groager does not run an ad network, does not sell cookie data to ad exchanges, and none of them are shared across unrelated websites (a visitor gets different cookie values on each separate website that uses Groager, since the cookies are first-party to each site);
• None of them contain your name, email address, or other directly identifying personal information — each is a random identifier or a timestamp;
• None are used for cross-site profiling or ad targeting by Groager or by any third party.

Separately from the cookies themselves, the tracking snippet also collects other visitor and session data (IP address, browser/device information, pages viewed, referrer, etc.) as described in full in our Privacy Policy, Section 2. That data is not stored in the cookies — the cookies only hold the identifiers/timestamps used to tie separate visits and page views together.

As a website visitor, you can control or remove these cookies the same way you would any other first-party cookie:

• Clear cookies for the specific website from your browser's settings (Site Settings / Privacy & Security in most browsers) — this deletes all four cookies and any subsequent visit will be treated as a new visitor and session;
• Use your browser's private/incognito browsing mode, which does not persist the cookies after the session ends;
• Your browser's “Do Not Track” (DNT) signal — the tracking snippet checks for this signal and, where a browser sends it, does not set these cookies or collect tracking data for that visit, unless the website owner has separately configured the snippet to require explicit consent instead. We honor DNT as a courtesy where our snippet can detect it, but we note honestly that DNT is not a legally binding or universally standardized signal — it was never formally adopted as a web standard, most browsers no longer offer a dedicated DNT setting, and not every site or service respects it. Don't rely on DNT alone if you need guaranteed opt-out; use the cookie-clearing or extension-based methods above, or the site's own consent controls if it has them, for a more reliable result.
• Use a browser extension or setting that blocks first-party analytics cookies generally.

As the website owner running the tracking snippet, whether you need to show your own visitors a cookie-consent banner for these cookies depends on the law that applies to your visitors (for example, ePrivacy/GDPR-influenced rules in the EU/UK commonly require consent for non-essential cookies). This determination — and the resulting compliance obligation — is entirely yours, not Groager's, to assess for your own site and audience; Groager is a processor providing the technical tooling (the snippet's data-consent-required attribute and consent()/optOut()/optIn() API), not the party responsible for deciding whether your specific site needs a banner. See our Terms of Service, Section 4, and our Privacy Policy, Section 2.

As described in Section 1 above and in our Privacy Policy, Section 1.3, the Groager dashboard authenticates you using a JSON Web Token (JWT) held in your browser's local storage for app.groager.com, not a cookie. Clearing local storage for app.groager.com, or signing out, ends your dashboard session.

Separately, on a website running the tracking snippet, if an analytics event cannot be sent immediately (e.g. the visitor is briefly offline), the snippet holds up to 50 pending events in a localStorage key on your website's own domain, and retries sending them periodically, dropping an individual event after 10 failed attempts so the queue cannot grow unbounded. This is purely a delivery-reliability mechanism — it holds the same event data described in our Privacy Policy, Section 2.2, temporarily, not a separate category of data collection.