Cookie policy
Last updated:
1. Overview
This page describes how we use cookies and similar technologies (including localStorage entries, browser storage, and transit-level metadata such as IP addresses in our hosting provider's server logs). To change your preferences (sometimes called "cookie settings"), use the Privacy choices link in the footer of any page on this site.
HoldingCost does not ask you to create an account or provide directly identifying information. However, analytics, advertising, security, and hosting technologies may process online identifiers (such as cookie ids, device fingerprints, and IP addresses) under our consent and privacy controls described below. See our privacy policy for the full picture.
2. Our consent model
HoldingCost groups cookies and storage into four user-controlled categories. Each category maps to a defined set of Google Consent Mode v2 signals — all seven signals are always set together, never partially. See our privacy policy for the full mapping.
- Necessary — required for the site to work (saving your preferences and basic security). Always on. Maps to
functionality_storage+security_storage. - Analytics — Google Analytics 4 collects anonymised usage data; Sentry captures browser errors for bug fixing. Maps to
analytics_storage. - Advertising storage — allows our advertising partner (Google AdSense) to measure how their ads perform. Maps to
ad_storage+ad_user_data. - Personalised ads — allows ads to be tailored to your interests across sites. Maps to
ad_personalization+personalization_storage. Currently disabled site-wide.
3. Regional consent flows
Visitors see one of two consent flows depending on the country we infer from their network connection:
- EEA, United Kingdom, and Switzerland — Google's Privacy & Messaging Consumer Management Platform (CMP), certified to IAB Transparency & Consent Framework v2.3, manages consent end-to-end. Configured in the AdSense console; activates only after the AdSense approval process completes.
- Everywhere else — HoldingCost's custom four-category consent banner controls whether analytics, advertising, and personalisation cookies are written.
Either way: no consent, no third-party cookies. The flow is decided once per page load based on country.
4. Cookie and storage inventory
The complete list of cookies, localStorage entries, and similar technologies that may be set when you use this site:
| Item | Provider | Category | Purpose | Retention | Set when |
|---|---|---|---|---|---|
hc_consent_v2 (localStorage) | HoldingCost | Necessary | Stores your four-category consent decision, the version of the categories at the time you decided, and the timestamp | 12 months (rolling) | First visit / banner save |
hc_analytics_consent (localStorage) | HoldingCost | Necessary | Earlier-format consent record retained for backwards compatibility with users who set their preferences before the current four-category banner. Used only for analytics consent; advertising consent always reads from the current record above. | 12 months (rolling) | Same as hc_consent_v2 |
hc_dev_country (localStorage) | HoldingCost | Necessary | Development-environment country override used by HoldingCost engineers when testing the regional consent flows. Never set in production. | Until cleared | Local dev only |
_ga, _ga_<id> | Google Analytics 4 | Analytics | Distinguish users and sessions | Up to 14 months (Google's setting) | Set when: Granted analytics consent |
_gid | Google Analytics 4 | Analytics | Distinguish users (24h) | 24h | Set when: Granted analytics consent |
__gads, __gpi, IDE, id | Google AdSense / DoubleClick | Advertising storage | Frequency capping; ad measurement | 1–13 months (per Google) | Set when: Granted advertising consent + ads are live on this site (currently disabled site-wide) |
| AdSense personalisation cookies | Google AdSense | Personalised ads | Cross-site interest profiles for ad targeting | Per Google's policy | Set when: Granted personalised-ads consent + personalised advertising is live on this site (currently disabled site-wide) |
| Sentry error monitoring (no cookie; error-event envelope) | Sentry | Analytics | Browser error capture for bug fixing; IP-address and user-agent enrichment and session replay are switched off | Per Sentry's retention policy | Set when: Granted analytics consent + error monitoring connected (currently dormant — not yet connected) |
| Cloudflare Web Analytics (no cookie; cookieless aggregate beacon) | Cloudflare | Cookieless (no consent required) | Privacy-first aggregate page-view measurement; no PII, no cross-site tracking | Aggregate only — no per-visitor record | Every page view, when enabled from the Cloudflare dashboard |
| Server logs (no cookie; transit metadata: IP, UA, timestamp) | Cloudflare | Necessary (legitimate interest) | Security, abuse prevention, bot mitigation | Per Cloudflare's retention policy | Every request |
Third-party cookies are written by the named provider, not by HoldingCost. We never set them ourselves; we only load the third-party script (Google Analytics, Google AdSense) once you have granted the corresponding consent category. Refer to Google's cookie policy for the authoritative description of each Google-provided cookie.
5. CCPA opt-out and Global Privacy Control
HoldingCost does not sell personal information. California residents can exercise the CCPA / CPRA right to opt out of any tracking technology by using the Privacy choices link in our footer to set Advertising storage and Personalised ads to "denied", or by setting our consent banner to "Reject non-essential". This is the equivalent opt-out path California guidance accepts when no sale occurs.
If your browser sends a Global Privacy Control (GPC) signal, we honour it automatically: advertising and personalised-ads tracking are denied, while analytics remain allowed. The behaviour is the same on every page — we check the signal fresh on each load.
6. Changes to this policy
If we add new cookie categories or change which third parties write cookies on our behalf, we will increment the version number that triggers re-consent so every existing user is re-prompted, and we will update the date at the top of this page. The 12-month rolling re-prompt also brings users back to the banner regardless of version changes.
7. Contact
For cookie-related enquiries, contact us at privacy@holdingcost.com.