Cookie Policy
Last updated: May 24, 2026
Eviddo sets a small number of cookies to keep you signed in and remember preferences. We also, with your consent, allow a handful of third parties to set cookies for analytics or advertising. Everything that isn't strictly necessary is off by default and only loads after you explicitly opt in.
You can change your choices at any time via the link in the footer.
1. Categories
- Necessary — required for the service to work. Cannot be turned off because the app would stop functioning.
- Functional — remember UI preferences (theme, last-viewed inspection). Off by default.
- Analytics — product analytics so we can understand feature usage. Off by default.
- Marketing — advertising pixels and session replay. Off by default.
2. Cookies we set
| Name | Category | Purpose | Expiry |
|---|---|---|---|
eviddo_consent | Necessary | Remember your cookie preferences. | 365 days |
access_token, refresh_token | Necessary | Authentication tokens issued by the Eviddo API — keep you signed in. | Access: 1 hour. Refresh: 30 days. |
__stripe_mid, __stripe_sid | Necessary | Stripe fraud prevention on the checkout and billing portal pages. | Session to 1 year |
_ga | Analytics | Google Analytics 4 — distinguishes anonymous visitors so feature-usage reports aren't double-counted. Only set after you opt in to the Analytics category. | 2 years |
_ga_<container-id> | Analytics | Google Analytics 4 session state. Only set after you opt in to the Analytics category. | 2 years |
3. Global Privacy Control
Browsers that send the Sec-GPC: 1 signal are automatically treated as "reject non-essential" without the consent banner. This is the opt-out mechanism recognised by California's CCPA and enabled by default in Brave, Firefox, and via the GPC extension in other browsers.
4. Third-party scripts
We load Google Analytics 4 on the public site to understand which features customers actually reach, gated by your Analytics consent. Google receives anonymised page view and event data — never your evidence files, never inspection content, never personal identifiers we control. We send the deny-all Consent Mode v2 signal before any Google script can load, so the script respects your choice even on the first request.
Any additional third-party script we wire in later will appear in the table above with its purpose, expiry, and category, and will only load after you consent to that category.
5. Contact
Email [email protected] with questions or to request a different consent decision than the one we currently record.