Cookie and Tracking Statement

The estimator sets no cookies

The EdgeQuote estimator, whether it is used at its own address or embedded in a contractor's website, sets no cookies and stores nothing in your browser. No cookies, no local storage, no session storage, no advertising pixel, no analytics script, no third-party tag manager, no session-replay or heat-mapping tool, and no fingerprinting.

This is verifiable rather than promised: there is no cookie-setting, localStorage or sessionStorage call anywhere in the estimator or the embed loader, including in the compiled bundle a browser actually receives.

Because the estimator stores nothing on your device, no consent banner is required for it under the EU ePrivacy Directive or the French rules the CNIL applies, and there is nothing to refuse.

What we count instead

We count, per contractor and per day, how many people viewed an estimator, started one, completed one, produced a lead, the total estimated value, and how many people answered each question. Those counters are produced on our server from the request itself and stored as daily totals. They contain no visitor identifier, no device identifier, and no IP address, and they cannot be traced back to an individual. There is no cross-site tracking of any kind.

Bot verification (Cloudflare Turnstile) runs on public forms to stop automated submissions. Cloudflare states that Turnstile does not use cookies for tracking purposes and does not collect personal information for advertising.

The contractor dashboard

Contractors who sign in to the dashboard receive two strictly necessary cookies:

Neither is used for analytics or advertising, and neither is set for anyone who has not signed in. Strictly necessary cookies do not require consent under the ePrivacy Directive (Art. 5(3), second sentence); they are described here for transparency.

Payment pages — [EFFECTIVE WHEN BILLING LAUNCHES]

As at 2026-09-06 the Service has no payment integration and the dashboard loads no payment script. When paid plans launch, the checkout and billing pages of the dashboard only will load Stripe's script, which sets Stripe's own cookies:

Stripe may document further necessary cookies from time to time at its cookie policy (stripe.com/legal/cookies-policy); this table will be updated to match before launch. These cookies are set only on pages where a card can be entered or a subscription managed. They are not set on the estimator, on the landing pages, or on any page a Homeowner sees. We do not use Stripe's cookies for our own analytics or advertising.

Fonts, and third-party requests generally

No page of the Service loads fonts from anyone else. The estimator's typefaces are files on our own domain, and an automated test fails the build if any font reference points anywhere else. The dashboard and landing pages use typefaces that are downloaded once when the software is built and then served from our own domain; the browser never contacts the font provider. Earlier versions of the estimator loaded fonts from Google's font service, which sent every visitor's IP address to Google on every page view; that request has been removed. The estimator's content security policy permits no external style or font source, so the request cannot silently return.

One third-party request remains, and only sometimes. If an estimator has come under automated abuse, bot verification (Cloudflare Turnstile) is switched on for that contractor for a limited period, and while it is on the estimator loads Turnstile from challenges.cloudflare.com. That request carries your IP address to Cloudflare, which uses it to decide whether you are a person. It is a security measure, it is not analytics or advertising, and when verification is off the request is not made at all. Nothing else external is loaded in either state.

Do Not Track and Global Privacy Control

Because we run no tracking, there is nothing for these signals to switch off. We treat a Global Privacy Control signal as a request to opt out of sale and sharing, which is already every visitor's position, so nothing changes when we receive one.

Which law applies, and why there is no banner

Our users are in the United States, the European Union and the United Kingdom, so both regimes apply and the stricter one governs how the Service is built:

• EU and UK. The ePrivacy Directive (Art. 5(3), implemented in France as art. 82 Loi Informatique et Libertés and in the UK as PECR reg. 6) requires prior opt-in consent before anything not strictly necessary is stored on or read from a device. Consent must be freely given, specific, informed and as easy to refuse as to give; the CNIL's 2020 guidelines and the ICO's guidance say the same. Strictly necessary storage is exempt.
• United States. There is no general prior-consent rule for cookies. State privacy laws (California CPRA and the others listed in the Privacy Policy) work on notice and opt-out, mainly of "sale" and "sharing" for cross-context advertising, and require honouring a Global Privacy Control signal as that opt-out. Wiretap-style claims under state laws such as the California Invasion of Privacy Act target session replay, chat interception and pixels; see the Tracking Inventory.

The Service satisfies both without a banner because it stores nothing non-essential on anyone's device. No banner is required, and none is shown. That conclusion holds only while the facts above stay true.

If a non-essential tracker is ever added — developer checklist

This section is written for the developer. It is not in force today, because nothing on the Service needs it. The moment an analytics tag, an advertising pixel, a session-replay tool, an embedded video player that sets cookies, or any script that stores an identifier is added to any page, all of the following must be true before the change ships:

1. Nothing non-essential runs before opt-in. The tag is not loaded, and no request to its domain is made, until the visitor has actively chosen to accept. "Continuing to browse" and scrolling are not acceptance (CNIL guidelines 2020; ICO guidance).
2. Reject is as easy as accept. The first layer of the banner shows an "Accept all" and a "Reject all" button of equal size and prominence, at the same level. No "Accept" against a buried "Manage settings" (CNIL enforcement against Google and Facebook, 2021–2022, turned on exactly this).
3. Nothing is pre-ticked. Every non-essential category defaults to off (CJEU, Planet49, C-673/17).
4. Granular by purpose. Analytics, functional and advertising are separate choices, each with a plain-language purpose and the list of third parties.
5. The choice is stored and withdrawable. Store the choice in a first-party cookie or local-storage key for no more than 6 months (the CNIL's ceiling), then ask again. Provide a permanent "Cookie settings" link in the footer that reopens the banner and allows withdrawal as easily as consent was given (GDPR Art. 7(3)).
6. Consent is recorded. Keep a log of what was shown, when, and what was chosen, so consent can be demonstrated (GDPR Art. 7(1)).
7. Honour Global Privacy Control as an opt-out of sale and sharing for US visitors, automatically, without a click.
8. Update this statement in the same change: add the cookie to the table with its purpose, provider and lifetime, and update the Privacy Policy and the Tracking Inventory. A cookie statement that does not match the site is itself a breach.
9. Never add a tracker to the estimator. It is embedded on third-party websites where the contractor's cookie notice, not ours, is what the visitor saw. A tracker there would fire on the contractor's domain without any consent mechanism we control.
10. Confirm with counsel first. Adding any tracker changes the answer in the previous section and needs a fresh legal check.

---

NOTES FOR YOUR LAWYER

1. The Google Fonts exposure has been closed on every surface. A German court (LG München I, 20 January 2022, 3 O 17493/20) found that transmitting a visitor's IP address to Google via the dynamic font service without consent infringed the GDPR, and that decision drove a wave of claims. The estimator's typefaces are vendored files under our own origin and a build-time test (src/lib/estimator-privacy.test.ts) fails if any font URL points elsewhere; the estimator CSP style-src and font-src are 'self' only. The dashboard and landing pages load their fonts through the framework's font loader, which downloads them at build time and serves them from our origin. Confirm by loading an estimator and the dashboard and checking the network panel for any fonts.gstatic.com or fonts.googleapis.com request.
2. "No consent banner required" is a conclusion, not a fact. It follows from the Service storing nothing non-essential on the device, which is verifiable. Confirm the reasoning holds for every jurisdiction in scope, and re-verify it if any third-party script is ever added. The developer checklist above is what would then apply.
3. Stripe's cookies are characterised as necessary. When billing launches, __stripe_mid and __stripe_sid are set on billing pages for fraud prevention. Our position is that they are strictly necessary to provide a service the user explicitly requested (taking their payment securely), which is the exemption in ePrivacy Art. 5(3) and the category the CNIL and the ICO treat as exempt. Confirm, because if they are not exempt a banner is needed on billing pages only. Stripe's own cookie policy also references a cookie set from m.stripe.network; verify Stripe's current list before launch and update the table.
4. Turnstile is the one third-party request today, and it is conditional: it loads only while bot verification is switched on for a given contractor, which happens after automated abuse and lapses on a timer. The characterisation that it sets no tracking cookie relies on Cloudflare's own published position; verify that directly. Confirm also whether a security measure that transmits an IP address to a US provider needs its own mention in the homeowner notice (it has one) or whether the reference in this statement is sufficient.
5. This statement will become false the moment anyone adds an analytics tag. It is a controlled document, to be checked whenever a script is added to the estimator or the dashboard. The automated privacy test guards the estimator; nothing automated guards the dashboard, so the developer checklist is the control there.

WHAT THIS DOES NOT COVER

• Cookies set by the contractor's own website on which the estimator is embedded. That page is theirs and its cookie notice is their responsibility.
• Cookies set by any destination a contractor connects a webhook to.
• The marketing pages at beyondtheedgestudio.com, which are a separate property with their own notice.