Cookie Policy

Effective: April 27, 2026

At a glance

• We set exactly 3 cookies. All are strictly necessary.
• Zero tracking cookies. Zero advertising cookies. Zero third-party cookies.
• Under EU ePrivacy Directive Article 5(3), strictly necessary cookies do not require your consent.
• Full details below.

1. What Are Cookies

Cookies are small text files stored on your device by your web browser when you visit a website. They allow the site to remember things like your login state between page loads.

PrivacyFetch does not use local storage or session storage for tracking purposes.

2. Cookies We Set

We set exactly three cookies. All are first-party (set by privacyfetch.com) and strictly necessary for the Service to function.

Technical notes:

• HttpOnly prevents JavaScript from reading the cookie. The session cookie is HttpOnly for security. The XSRF-TOKEN cookie is intentionally not HttpOnly because the frontend must read it to set the X-XSRF-TOKEN request header.
• Secure ensures the cookie is only sent over HTTPS connections.
• SameSite=Lax prevents the cookie from being sent in cross-site requests except for top-level navigations, providing protection against CSRF attacks.

3. What We Do NOT Use

We want to be explicit:

• No advertising or retargeting cookies. We do not integrate with ad networks.
• No social media tracking pixels. We do not load scripts from Facebook, X/Twitter, LinkedIn, TikTok, or similar platforms.
• No third-party analytics cookies. See Section 4 for details on our consent-gated analytics.
• No fingerprinting or supercookies. We do not use canvas fingerprinting, audio fingerprinting, or any other fingerprinting technique.
• No local storage or session storage for tracking. We use these browser APIs only for functional purposes (e.g. UI state), never for tracking.
• No third-party cookies of any kind. All cookies on privacyfetch.com are set by us.

4. Consent-Gated Analytics

We have Google Tag Manager (GTM) configured on the site. However:

• GTM's default consent mode is set to deny all — analytics storage, ad storage, ad user data, and ad personalization are all denied by default.
• No GTM analytics scripts execute unless you explicitly grant consent.
• If you consent to analytics in the future (when we implement a consent banner), GTM may set additional cookies. We will list those cookies here before activating them.

Currently, GTM is effectively inactive for all users because consent is never granted by default.

5. Third-Party Service Cookies

Some third-party services we use may process limited data through your browser:

Bunny Fonts

We load web fonts from Bunny Fonts, a privacy-focused font CDN based in the EU. Bunny Fonts processes your IP address ephemerally to serve font files. It does not set cookies and does not store personal data.

Stripe

When you interact with a payment form (e.g. during checkout or updating your payment method), Stripe's JavaScript SDK may set cookies for fraud prevention. These cookies are controlled by Stripe and are subject to Stripe's Cookie Policy. They are only active while the payment form is loaded.

6. How to Control Cookies

You can block or delete cookies through your browser settings. Here are links to cookie management for common browsers:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

Please note: If you block the privacyfetch-session cookie, you will not be able to log in. If you block the XSRF-TOKEN cookie, form submissions will fail. Other site features (browsing the directory, reading public company profiles) will continue to work without cookies.

7. Do Not Track (DNT)

We respect the Do Not Track browser signal. Since we do not track users across websites and do not engage in cross-site tracking, the DNT signal has no practical effect on our service — but we honor it as a matter of principle.

8. ePrivacy Directive Compliance

Under Article 5(3) of the ePrivacy Directive (2002/58/EC, as amended by 2009/136/EC), cookies that are strictly necessary for providing a service explicitly requested by the user are exempt from the consent requirement.

All three cookies we set qualify as strictly necessary:

• The session cookie is required for authenticated access.
• The CSRF cookie is required for secure form submissions.
• The consent cookie records your acknowledgment and is itself exempt as it prevents repeated interruptions.

9. Changes to This Policy

If we ever add cookies that are not strictly necessary (e.g. analytics, marketing), we will:

• Update this policy before setting those cookies.
• Implement a consent mechanism so you can choose whether to accept them.
• Notify registered users of the change by email.

10. Contact

If you have questions about our use of cookies, contact us:

• Data Protection Officer: dpo@privacyfetch.com
• General support: support@privacyfetch.com

See also: Privacy Policy · Terms of Service