This document is draft content from a standard template and has not been reviewed by legal counsel.
[Requires legal review]
Clauses marked [Pending review: …] require jurisdiction-specific customization before publication.
About this policy
Driftless is an agentic product delivery platform provided by Iron Flank Inc. (“Driftless”, “we”, “us”, “our”). This Cookie Policy explains the cookies and similar technologies (such as local storage) we use across two domains:
- Marketing website —
godriftless.ai (and www.godriftless.ai): the public site you are reading now. It loads Google Analytics to measure aggregate usage, and uses local storage to remember your cookie consent choice.
- Application —
app.godriftless.ai: the logged-in product. It uses authentication session tokens and local storage for user preferences. It does not use any third-party tracking cookies.
Cookies are small text files placed on your device when you visit a website. Local storage is a browser feature that lets a site store data on your device without an expiry set by the server. This policy covers both, because the consent mechanism that gates optional tracking is stored in local storage rather than a cookie.
This policy should be read alongside our Privacy Policy, which describes what personal data we collect and how we use it, and our Terms of Service.
Cookies on godriftless.ai (marketing site)
The marketing website uses Google Analytics 4 to measure aggregate, pseudonymized usage — which pages are visited, how visitors arrive, and approximate geographic region. Google Analytics sets the cookies below. It also stores your consent choice in local storage.
| Name |
Purpose |
Category |
Duration |
_ga |
Distinguishes unique visitors. Generates a random client identifier used to calculate visitor, session, and campaign metrics. |
Optional (analytics) |
2 years |
_ga_<container-id> |
Maintains session state for the Google Analytics 4 measurement tag for a given property. The <container-id> portion is the GA4 measurement ID (for example, _ga_HSGXH93TSS). |
Optional (analytics) |
2 years |
Local storage on the marketing site
Your cookie consent choice is stored in the browser’s local storage under the key driftless_cookie_consent. It is not a cookie and has no server-set expiry; it persists until you clear your browser storage or change your choice.
Schema:
Key: driftless_cookie_consent
Value: {
"status": "accepted" | "declined",
"timestamp": "<ISO-8601 string>"
}
No personal data is stored in the consent record, and it is never sent to our servers.
Google Analytics does not load — and the cookies above are never set — until you accept cookies via the consent banner. See Google Analytics & consent for the full gating mechanism.
[Pending review: confirm the exact GA4 measurement ID, cookie durations, and any additional GA4 parameters collected once the tracking implementation is finalized]
Cookies on app.godriftless.ai (application)
The application uses only strictly necessary cookies and local storage to operate and keep you signed in. It does not use Google Analytics or any other third-party tracking.
Strictly necessary cookies
Authentication session tokens are required to keep you signed in and to secure requests to the API. These cookies load regardless of your consent choice because the application cannot function without them. Removing them logs you out.
| Name |
Purpose |
Category |
Duration |
[Pending review: session cookie name, e.g., driftless_sid] |
Authentication session token identifying your logged-in session. |
Strictly necessary |
[Pending review: session — expires on logout or after N days] |
[Pending review: CSRF token cookie name] |
Anti-cross-site-request-forgery token protecting form and API submissions. |
Strictly necessary |
Session |
Local storage on the application
The application stores user-interface preferences and your cookie consent choice in local storage. These are not cookies and contain no personal data beyond what is required to remember your settings.
- App cookie consent — key
driftless_app_cookie_consent (a separate key from the marketing site to avoid consent-state collision between domains). Schema: { "status": "accepted" | "declined", "timestamp": "<ISO-8601 string>" }.
- UI preferences —
[Pending review: list app-specific localStorage keys, e.g., theme, collapsed-sidebar state].
Because the application loads no optional analytics scripts, the “Accept” and “Decline” buttons in the app consent banner have identical behavior today: no third-party scripts are gated either way. Strictly necessary cookies and local storage load regardless of your choice.
Cookie categories
We group the cookies and storage items above into two categories.
Strictly necessary
These are required for the service to function. They enable authentication, session security, and core application behavior. They load regardless of your consent choice and cannot be disabled without breaking the application — for example, you would be unable to stay signed in.
- Authentication & session tokens — on
app.godriftless.ai, identify your logged-in session.
- Security tokens (CSRF) — protect form and API requests on the application.
- Core UI preferences — local storage that keeps the application usable (layout, theme).
Optional
These are not required for the service to function. They are used only for analytics and are gated behind your consent. They do not load until you accept cookies.
- Google Analytics — on the marketing site (
godriftless.ai) only. Measures aggregate usage via the _ga and _ga_<container-id> cookies.
Summary by domain.
godriftless.ai — strictly necessary: none required to render static pages; optional: Google Analytics (consent-gated); local storage: consent state.app.godriftless.ai — strictly necessary: auth/session + CSRF cookies; optional: none; local storage: consent state + UI preferences; no third-party tracking.
Google Analytics and consent
The marketing site (godriftless.ai) uses Google Analytics 4 (property G-HSGXH93TSS) to measure aggregate usage. Google Analytics is gated behind explicit consent: the GA scripts do not load, and no GA cookies are set, until you click “Accept” in the cookie consent banner.
Cookies set by Google Analytics
When you accept, Google Analytics sets the following cookies on the godriftless.ai domain:
_ga — distinguishes unique visitors with a random client identifier; persists for 2 years._ga_<container-id> — maintains session state for the GA4 measurement tag (for example, _ga_HSGXH93TSS); persists for 2 years.
No GA cookies are set if you decline or if no consent choice has been made.
How consent gating works
The GA script tags are not included in the initial page HTML. Instead, a loadAnalytics() function dynamically injects the GA script only after consent is granted. On every page load, the site checks local storage:
- Consent previously accepted (
status === "accepted") — loadAnalytics() runs immediately, restoring analytics for returning visitors who already accepted.
- Consent declined (
status === "declined") — GA does not load. No GA cookies are set.
- No consent record — GA does not load and the consent banner is shown. If you then click Accept,
loadAnalytics() runs and your choice is stored; if you click Decline, your choice is stored and GA never loads.
Strictly necessary cookies are never gated by this mechanism — they load regardless of your consent choice. The consent state is stored only in local storage (key driftless_cookie_consent); it is never sent to our servers.
On the application
The application (app.godriftless.ai) does not load Google Analytics or any third-party tracking. Its consent banner is a compliance formality: “Accept” and “Decline” have identical behavior because there are no optional scripts to gate. If analytics are added to the application in the future, they will be wrapped in the same consent check.
[Pending review: if GA4 consent mode is later integrated, document the consent-mode signals and default state here]
Managing and disabling cookies
You control cookies and local storage through your browser. You can block all cookies, accept only first-party cookies, delete existing cookies, or clear local storage. Because our optional analytics are consent-gated, declining the banner already prevents GA from loading — you do not need to change browser settings to stop analytics, though you can also block them at the browser level for any site.
Disabling cookies in common browsers
Most browsers let you manage cookies under Settings → Privacy & Security. The exact menu names vary; the links below go to each browser’s official guidance.
- Google Chrome — Settings → Privacy and security → Third-party cookies.
[Pending review: link to Chrome’s cookie-management help article]
- Mozilla Firefox — Settings → Privacy & Security → Cookies and Site Data.
[Pending review: link to Firefox’s cookie-settings help article]
- Safari (macOS) — Settings → Privacy → Manage Website Data / Cookies and website data.
[Pending review: link to Safari’s privacy help article]
- Microsoft Edge — Settings → Cookies and site permissions → Manage and delete cookies and site data.
[Pending review: link to Edge’s cookie help article]
Blocking or deleting strictly necessary cookies will prevent the application from keeping you signed in and may break core functionality. Blocking optional (analytics) cookies has no effect on site functionality.
How clearing local storage affects your consent
Your consent choice lives in local storage, not in a cookie. If you clear your browser’s site data, local storage, or browsing data for godriftless.ai or app.godriftless.ai, your stored consent record is removed and the consent banner will appear again on your next visit. Clearing local storage has these effects:
- Marketing site — removing
driftless_cookie_consent resets your choice. The banner reappears, and until you accept again, Google Analytics does not load and no GA cookies are set.
- Application — removing
driftless_app_cookie_consent resets your choice and the banner reappears. Removing UI-preference keys reverts interface settings to their defaults. Authentication is unaffected because it is held in a strictly necessary cookie, not local storage.
To change your mind without clearing all site data, you can usually remove the specific driftless_cookie_consent (or driftless_app_cookie_consent) key from your browser’s site-data inspector, after which the banner will show again on the next visit.
[Pending review: if a persistent “manage consent” control is added to the site footer, document how to reopen the consent banner here]
Third-party cookies
The only third-party cookies used anywhere on Driftless are the Google Analytics cookies (_ga and _ga_<container-id>) on the marketing site (godriftless.ai), and only after you accept cookies.
- Marketing site (
godriftless.ai): Google Analytics is the sole third-party service. Its cookies are consent-gated and used only for aggregate usage measurement. No advertising or cross-site tracking cookies are set.
- Application (
app.godriftless.ai): no third-party cookies and no third-party tracking of any kind. Authentication, session, and security cookies are first-party and strictly necessary.
We do not use advertising networks, remarketing tags, social-media tracking pixels, or any other third-party tracking technology on either domain. [Pending review: if additional third-party services are introduced, list them here with their purpose and cookie names]
This page is draft template content and is not final legal advice. It will be reviewed by qualified legal counsel before publication, at which point this notice will be removed.
