Cookie and Tracking Statement
This is an earlier version, kept for the record. The current version (0.2) is at /legal/cookies.
DRAFT for attorney review. Not legal advice.
The estimator sets no cookies
The EdgeQuote estimator, whether it is used at its own address or embedded in a contractor's website, sets no cookies and stores nothing in your browser. No cookies, no local storage, no session storage, no advertising pixel, no analytics script, no third-party tag manager, no session-replay or heat-mapping tool, and no fingerprinting.
This is verifiable rather than promised: there is no cookie-setting, localStorage or sessionStorage call anywhere in the estimator or the embed loader, including in the compiled bundle a browser actually receives.
Because the estimator stores nothing on your device, no consent banner is required for it under the EU ePrivacy Directive or the French rules the CNIL applies, and there is nothing to refuse.
What we count instead
We count, per contractor and per day, how many people viewed an estimator, started one, completed one, produced a lead, the total estimated value, and how many people answered each question. Those counters are produced on our server from the request itself and stored as daily totals. They contain no visitor identifier, no device identifier, and no IP address, and they cannot be traced back to an individual. There is no cross-site tracking of any kind.
Bot verification (Cloudflare Turnstile) runs on public forms to stop automated submissions. Cloudflare states that Turnstile does not use cookies for tracking purposes and does not collect personal information for advertising.
The contractor dashboard
Contractors who sign in to the dashboard receive two strictly necessary cookies:
| Cookie | Purpose | Type | Lifetime |
|---|---|---|---|
eq_session | Keeps a signed-in user signed in | First-party, strictly necessary | Until the session expires or the user signs out |
eq_view_as | Records that an agency administrator is temporarily viewing a specific contractor's account | First-party, strictly necessary | For the duration of that view |
Neither is used for analytics or advertising, and neither is set for anyone who has not signed in. Strictly necessary cookies do not require consent under the ePrivacy Directive; they are described here for transparency.
Fonts, and third-party requests generally
The estimator no longer loads fonts from anyone else. Its typefaces are served from our own domain, not from a font CDN. Earlier versions loaded them from Google's font service, which sent every visitor's IP address to Google on every page view; that request has been removed and the fonts are now self-hosted. The estimator's content security policy no longer permits any external style or font source, so the request cannot silently return.
One third-party request remains, and only sometimes. If an estimator has come under automated abuse, bot verification (Cloudflare Turnstile) is switched on for that contractor for a limited period, and while it is on the estimator loads Turnstile from challenges.cloudflare.com. That request carries your IP address to Cloudflare, which uses it to decide whether you are a person. It is a security measure, it is not analytics or advertising, and when verification is off the request is not made at all. Nothing else external is loaded in either state.
Do Not Track and Global Privacy Control
Because we run no tracking, there is nothing for these signals to switch off, and we do not behave differently when we receive one.
NOTES FOR YOUR LAWYER
- The Google Fonts exposure has been closed. A German court (LG München I, 20 January 2022, 3 O 17493/20) found that transmitting a visitor's IP address to Google via the dynamic font service without consent infringed the GDPR, and that decision drove a wave of claims. The estimator no longer makes that request: the typefaces are vendored and served from our own origin, and the estimator's CSP
style-srcandfont-srcare now'self'only, so the request cannot reappear without a deliberate policy change. Confirm the claim by loading an estimator and inspecting the network panel for anyfonts.gstatic.comrequest. - "No consent banner required" is a conclusion, not a fact. It follows from the estimator storing nothing on the device, which is verifiable. Confirm the reasoning holds for every jurisdiction in scope, and re-verify it if any third-party script is ever added.
- Turnstile is the one remaining third-party request, and it is conditional: it loads only while bot verification is switched on for a given contractor, which happens after automated abuse and lapses on a timer. The characterisation that it sets no tracking cookie relies on Cloudflare's own published position; verify that directly rather than relying on this document. Confirm also whether a security measure that transmits an IP address to a US provider needs its own mention in the homeowner notice, or whether the reference in this statement is sufficient.
- This statement will become false the moment anyone adds an analytics tag. It should be treated as a controlled document, checked whenever a script is added to the estimator or the dashboard.
WHAT THIS DOES NOT COVER
- Cookies set by the contractor's own website on which the estimator is embedded. That page is theirs and its cookie notice is their responsibility.
- Cookies set by any destination a contractor connects a webhook to.
- The marketing pages at beyondtheedgestudio.com, which are a separate property with their own notice.