Cookie Policy
Effective: 2026-05-17 · Last updated: 2026-07-24
This page explains what cookies and similar browser-storage technologies consalsa.app — operated by Data Sauna LLC (a Wyoming, USA limited liability company) — uses, the legal basis for each, and how you can control them. It should be read together with our Privacy Policy. Short version: the site runs on a few strictly-necessary, first-party storage entries plus cookieless traffic counters. We also use optional analytics and advertising tools, most of which load only after you accept cookies in the banner. The one exception is Google AdSense, which serves the ads that pay for the site: it runs for every visitor, but requests non-personalized ads unless you accept.
When you first visit, a banner asks you to accept or reject non-essential cookies. Pressing Accept is what turns on Google Analytics' cookie-based mode, Microsoft Clarity, and the Meta Pixel — none of those store anything on your device before that. Two things run either way: Google Analytics in its cookieless "consent denied" mode, and Google AdSense in non-personalized mode (see section 2, "Advertising"). If you press Reject, or ignore the banner, that is all that runs, alongside the strictly-necessary storage and the cookieless counters. You can change your mind at any time using the "Cookie settings" link in the footer (see section 5).
If you are visiting from the EEA, the UK, or Switzerland, you will see Google's consent message instead of our banner — one prompt, not two. Google's message is a certified consent management platform, and in those regions it is the record that governs everything described below, including our own analytics. Section 2 has the detail.
1. What cookies are
Cookies are small text files placed on your device by a website. Similar
technologies include localStorage, sessionStorage,
pixels, and SDKs. Under the EU ePrivacy Directive, the UK Privacy and Electronic
Communications Regulations (PECR), and similar laws elsewhere, storing or
accessing information on a user's device generally requires either prior consent
or the "strictly necessary" exemption.
2. Cookie and storage categories on consalsa.app
Strictly necessary (no consent required)
| Name | Type | Purpose | Duration | Provider |
|---|---|---|---|---|
cookie-consent | localStorage entry | Stores whether you accepted or rejected non-essential cookies, so we can honor your choice and not ask again. Contains the word granted or denied only. | Persistent (until you clear browser data) | consalsa.app (first-party) |
cs_popup_shown_at | localStorage entry | Timestamp of when we last showed you the newsletter signup popup. Used to make sure we don't show it again for 30 days, so the experience stays calm. Contains a number only — no identifier. | 30 days (then auto-eligible to be overwritten) | consalsa.app (first-party) |
cs_subscribed | localStorage entry |
Set to 1 after you successfully sign up for the
newsletter — from any form on the site — so that the signup popup
stops showing on subsequent visits. Contains a boolean flag
only; no email or identifier.
| Persistent (until you clear browser data) | consalsa.app (first-party) |
Legal basis: strictly necessary for the functioning of the site
as requested by you (Article 5(3) ePrivacy Directive exemption; "necessary"
processing under Article 6(1)(f) GDPR for the underlying personal-data aspect, of
which there is effectively none, since these values contain no identifier).
The two cs_* entries exist purely to suppress repeat popups — without
them, we could not respect your "no thanks" the next time you visit.
Cookieless analytics (no consent prompt required)
We use two cookieless tools that run for every visitor to measure
aggregate traffic:
Vercel Analytics
and
Cloudflare Web Analytics.
Neither sets cookies, localStorage, or sessionStorage, and
neither uses a device identifier or fingerprint. They collect anonymized page-view
metadata (page URL, referrer, country, device type, browser). Because nothing is
stored on or read from your device, the ePrivacy Article 5(3) consent requirement
does not apply. Lawful basis: legitimate interest under Article
6(1)(f) GDPR.
Analytics
We use analytics tools that help us see which words and pages are useful and where people get stuck. Google Analytics 4 runs for every visitor, but by default (before you accept) it operates in a cookieless "consent denied" mode under Google Consent Mode: it sets no cookies and uses no persistent identifier, sending only anonymized, aggregated pings. It sets the cookies listed below and enables full measurement only after you accept. Microsoft Clarity (heatmaps and session replay) does not load at all unless you accept.
| Provider | Purpose | Typical storage | More info |
|---|---|---|---|
| Google Analytics 4 (Google Ireland Ltd.) | Aggregate audience and traffic measurement — pages viewed, referrers, rough location, device. | First-party cookies (e.g. _ga, _ga_*), up to ~2 years. | Google privacy |
| Microsoft Clarity (Microsoft Corp.) | Aggregate heatmaps and session replay to see how pages are actually used. Text you type is masked by default. | First-party and Microsoft cookies (e.g. _clck, _clsk), up to ~1 year. | Microsoft privacy |
Advertising
Google AdSense serves the display ads that pay for the site, so
its script loads for every visitor, before and regardless of your cookie choice.
Until you accept, we set Google's requestNonPersonalizedAds flag, and
Google's Consent Mode v2 signals for ad storage, ad user data, and ad
personalization are all set to denied. That means
non-personalized ads: selected from general context — roughly the
page you are on and your approximate location — rather than a profile of your
browsing history. Non-personalized does not mean storage-free. Google can still set
cookies and read device storage, including first-party cookies on
consalsa.app, for frequency capping, ad measurement, and
invalid-traffic detection. Accepting cookies upgrades AdSense to personalized ads
from your next page view onward.
The Meta (Facebook) Pixel is different: it loads only if you accept, and lets us measure whether our social posts and ads bring people to the site, and reach similar audiences.
Google's consent message (EEA, UK, Switzerland). Google requires publishers to use a certified consent management platform before serving personalized ads to visitors in those regions, so we use Google's own. If you are in the EEA, the UK, or Switzerland, Google shows you its own message — with Consent, Do not consent, and Manage options — and our own banner stays hidden, so you get one prompt rather than two. Google's message records your choice in the industry-standard IAB Transparency and Consent Framework (TCF v2.2), and we read that same signal to decide whether to run our analytics tools: Google Analytics' cookie-based mode and Microsoft Clarity follow your consent for storing information on your device and measuring content performance, and the Meta Pixel follows your consent for advertising purposes. In other words, in those regions Google's message governs everything on this page, not just ads. Visitors elsewhere in the world do not see it and use our banner instead.
| Provider | Purpose | Typical storage | More info |
|---|---|---|---|
| Google AdSense (Google Ireland Ltd.) | Serving the display ads that fund the site, plus frequency capping, ad measurement, and invalid-traffic detection. Personalized only after you accept; non-personalized otherwise. | First-party cookies set on consalsa.app by the AdSense script (e.g. __gads, __gpi), typically up to ~13 months, plus Google cookies on google.com / doubleclick.net (e.g. IDE, test_cookie) and browser storage on Google's own domains. Some of these are set before you make a cookie choice, including in non-personalized mode. | Google advertising |
| Meta Pixel (Meta Platforms Ireland Ltd.) | Conversion measurement and audience building for Facebook / Instagram campaigns. Loads only after you accept. | Cross-site cookies (e.g. _fbp), up to ~3 months. | Meta privacy |
Legal basis: for anything that stores cookies or data on your device — Google Analytics after you accept, Microsoft Clarity, the Meta Pixel, and personalized ads through Google AdSense — your consent (Article 6(1)(a) GDPR and the Article 5(3) ePrivacy consent rule). Google Analytics' cookieless "consent denied" pings rely on our legitimate interest under Article 6(1)(f). Consent is optional, and you can withdraw it at any time (section 5). You can also manage Google's ad settings directly at My Ad Center, and opt out of many third-party vendors' use of cookies for personalized advertising at aboutads.info/choices or youronlinechoices.eu.
Where this setup is limited. Ad serving reads and writes information on your device even in non-personalized mode, and the AdSense script runs before you make a choice. In the EEA and UK, a strict reading of the ePrivacy consent rule would require consent for that too, not only for personalization. We would rather say this plainly than imply a stricter gate than the one that exists. If you do not want any ad-related storage, block third-party cookies and scripts for this site in your browser, or use an ad blocker — nothing on the site is gated behind seeing ads.
3. Third-party cookies on this domain
Apart from Google AdSense — described in section 2, which can set its own
first-party cookies on consalsa.app (for example __gads
and __gpi) as soon as an ad loads, including before you make a cookie
choice — no third-party tool sets cookies on this domain unless you accept
non-essential cookies. If you accept, the analytics and advertising tools above
(Google, Microsoft, Meta) may set their own cookies. Fonts (Bangers and Inter
Tight) are self-hosted from our own server, so no requests are made to Google Fonts
or any other font CDN.
Our hosting provider (Vercel), our email provider (Resend), and Google (ad serving through AdSense, including in non-personalized mode) may set cookies on their own domains in connection with their services, but those cookies are not set on, nor accessible from, consalsa.app. See their respective cookie/privacy pages for details:
4. About the cookie banner
The banner is a genuine consent gate for Google Analytics'
cookie-based mode, Microsoft Clarity, and the Meta Pixel: press
Accept and we record your choice in cookie-consent
and load them; press Reject, or ignore the banner, and they never
load. It is not a gate for Google AdSense. The AdSense script
loads for every visitor either way, because it serves the ads that pay for the site
— what the banner controls is whether those ads are personalized. Rejecting keeps
them non-personalized; it does not remove them, and it does not stop Google from
setting ad-serving cookies for frequency capping, measurement, and invalid-traffic
detection. You can revisit this choice at any time using the
"Cookie settings" link in the site footer.
In the EEA, the UK, and Switzerland this banner does not appear at all — Google's certified consent message takes its place, and your answer there drives the same tools. The "Cookie settings" link in the footer re-opens whichever prompt applies to you.
Your answer here does not govern the newsletter signup popup, and
does not need to: it is our own interface, it sets no cookie, and it loads nothing
from a third party. The two entries above (cs_popup_shown_at and
cs_subscribed) are written either way, because they are what caps the
popup at once per 30 days and retires it entirely once you have signed up — they
have to keep working for someone who declined. The popup will never open on top of
this banner or of Google's consent message; it waits until the prompt is answered
or gone.
5. How to control or remove cookies and storage
You can clear cookies and localStorage at any time through your
browser settings. Most browsers also let you block first-party or third-party
cookies entirely; this may affect site functionality on other sites you visit.
To withdraw consent for the analytics and advertising tools, use
the "Cookie settings" link in the site footer at any time. It
re-opens whichever prompt applies to you: our banner in most of the world, or
Google's consent message in the EEA, the UK, and Switzerland. (You can also clear
this site's cookies and localStorage in your browser, which removes the
cookie-consent flag and brings the banner back.) Withdrawing downgrades
Google Analytics to its cookieless mode, stops Microsoft Clarity and the Meta Pixel
from loading on future visits, and returns AdSense to non-personalized ads.
We honor the Global Privacy Control (GPC) signal. If your browser or extension sends it, we treat it as a standing opt-out: analytics cookies, Microsoft Clarity, and the Meta Pixel stay off, ads stay non-personalized, and Consent Mode stays denied — even if an Accept is already stored from an earlier visit. To opt out of Vercel Analytics on this site specifically, you can use a content blocker or a GPC signal. If you'd like a manual opt-out, email us at hola@consalsa.app.
6. Changes to this policy
We'll update this policy if our use of cookies or similar technologies changes. The "Effective" and "Last updated" dates at the top of this page show when it was last revised.
7. Contact
Questions about cookies, tracking, or privacy? Email hola@consalsa.app, reply to any newsletter email, or use the contact page.