Cookie policy

The short version #

We do not use advertising cookies. We do not use cross-site tracking pixels. We do not sell anything about your visit to anyone, and nobody is building a profile of you out of this website.

What we do keep is a few small values, all of them about how the page behaves rather than about you: whether the opening animation has already played, which button you pressed on the cookie bar, whether you closed an announcement at the top of the site, and a random number for the tab you are in, which lets us count page views without knowing who you are. They are all listed by name in section 3. Two more appear briefly when you pay, and those belong to the card processor.

Cookies, and the other two things people call cookies #

Most cookie policies use the word “cookie” for three different things. They are worth telling apart, because they do not behave the same way.

A cookie

A small piece of text your browser stores and then sends back to the server with every single request to that site. That is what makes cookies useful for logging in, and what makes them useful for tracking. A cookie has an expiry date built into it, and the site that set it chooses that date.

localStorage

A small store in your browser that is never sent anywhere. Only scripts on the pages of that same site can read it. It has no expiry date at all: what is put there stays until something removes it, which usually means you clearing your browsing data.

sessionStorage

The same idea, but tied to the tab. Close the tab and it is gone, with no action from you and no way for the site to keep it.

The difference matters: something in localStorage cannot be read by another website, cannot be read by our servers, and does not travel with your requests. It is a note the page leaves for itself.

The rules that apply are not written about cookies as such. They are written about storing information on your device, or reading information already stored there, whatever the technique. So all three count, and all three are listed below.

Everything this site stores #

This is the complete list for deviqo.com. If you look in your browser’s developer tools and find something here that is not on this list, please tell us at [email protected], because it means we have missed something and we will want to fix both the site and this page.

One of these, deviqoSid, is not strictly necessary in the narrow sense section 10 describes, and we have said so rather than marking everything as essential, which is the usual dodge. It holds a random number made up in your tab and nothing that could identify you, and it disappears when the tab closes. Press Essential only on the cookie bar, or send a Global Privacy Control or Do Not Track signal, and it is never created. Section 7 says how to clear anything else on this list.

There is no login cookie in the list because the dashboard is a separate, signed-in service. When you log in, a session cookie is set for as long as you stay logged in, and it is deleted when you log out. It exists only to keep you logged in, which is as strictly necessary as it gets.

At the payment step #

Card payments are handled by Stripe, and its fraud checks need to recognize the browser making the payment. Those two cookies appear only on the pages that carry the payment form, and they are set by Stripe, not by us. We cannot read them.

Preventing card fraud is treated as strictly necessary, and it is not something we would want to switch off. Blocking these means the payment form will not work. What Stripe does with them is set out in its own privacy policy.

How we count visits, without cookies #

We do want to know which pages are read and which are ignored, because that is how the site gets better. We do it without cookies.

We count it ourselves, on our own server, and hand it to nobody. What is written down is the page, the date and time, whether the screen was phone sized, which link was pressed, how far down the page you got and how long you were on it. No IP address, no browser string and no text you typed is ever written to that store. There is no cookie, no advertising pixel and no third party involved at any point.

One thing is written into your browser: a short random number, kept in your tab’s own storage, so that four pages read one after another can be counted as one visit rather than four. It is not a cookie, it is never sent to anyone else, it cannot be matched to your name or your email, and it is gone the moment you close the tab. Open the site tomorrow and you are someone new.

Raw lines are kept for 90 days and then deleted. What survives is the counts, with nobody attached to them.

What we get out of it is a count. “Four hundred people read the hosting page last week, most of them on a phone.” That is all we need, and it is all we take. If you want the same discipline on your own site, measuring what works without drowning in analytics sets out the handful of numbers worth watching and the twenty that waste an evening.

If we ever change to a method that does need a cookie, it will not load until you have said yes, and this page will say so before it happens.

The bar at the bottom, and changing your mind #

On your first visit a small bar appears with two buttons, Essential only and OK. Whichever you press, the answer is written to deviqoCookies so you are not asked again. Nothing is loaded or unloaded as a result today, because as section 3 explains there is nothing optional to load. The choice is recorded so that it is already there and already respected if that ever changes.

To be asked again, clear this site’s storage in your browser using the instructions below. The bar will reappear on your next visit.

We do not use a design that makes refusing harder than accepting. The two buttons sit side by side, the bar does not cover the page, and it does not come back if you ignore it.

Turning them off in your browser #

Menu names move around between versions, so these are described by where to look rather than by an exact sequence of clicks. In all four, the setting for a single site is normally reached by clicking the padlock or the icon at the left of the address bar while you are on that site.

Chrome

Settings, then the privacy and security section. There you can block third-party cookies, block them for particular sites, and clear browsing data for a chosen period. On Android the same settings are in the browser’s own menu.

Safari

Settings or Preferences, then the privacy section. There is a switch to block all cookies, and a manage website data option that lets you delete what one site has stored. On iPhone and iPad it is under Safari in the device settings.

Edge

Settings, then the cookies and site permissions section, which controls what may be stored and lets you see and delete what individual sites have already stored.

Firefox

Settings, then privacy and security. Enhanced tracking protection has standard, strict and custom levels, and the cookies and site data section clears what is there or blocks it in the future.

Two things to know before you do it. Clearing site data for deviqo.com signs you out of your dashboard, because the login cookie goes with everything else. And blocking all cookies everywhere will break the checkout on most websites, including ours, because the fraud checks in section 4 depend on them.

A private or incognito window is the simplest option of all: everything stored is discarded when you close it.

Do Not Track and Global Privacy Control #

Some browsers send a Do Not Track header, and some send a Global Privacy Control signal. The two are not the same thing: Do Not Track is a request nobody was ever obliged to honor, while the Global Privacy Control is treated by a growing list of state privacy statutes as a valid opt-out of the selling or sharing of personal information, which a business those statutes reach has to act on and has to say it acts on.

Our commitment is the same for everybody, and it does not depend on which state you are in. If your browser sends a Global Privacy Control signal, we treat it as your opt-out of any sale of your personal information, any sharing of it for cross-context behavioral advertising, and any use of it for targeted advertising. We record that opt-out against your browser and we act on it. We treat a Do Not Track header the same way, even though nothing obliges us to. We do not ask you to prove you live in a state that gives you the right, we do not ask you to log in first, and we do not make you fill in a form as well.

There is also something concrete it switches off. We measure how our own pages and dashboard are used, as section 5 describes. If your browser sends either signal, that measurement does not run at all for you: the script never starts, and if it somehow did, our server refuses the request before reading it. Nothing about your visit is written down.

Beyond that we do not track you across sites whether you send the signal or not. There is no advertising network on this site, no tracking pixel, no cross-site advertising audience and no third party we hand your browsing to. No other party collects information about what you do on other sites when you use deviqo.com or your dashboard.

Two things follow. We will not add anything to this site that sells or shares your personal information for advertising without saying so on this page before it goes on. And if we ever do add something of that kind, the code that honors the Global Privacy Control ships with it, in the same piece of work, and not as a promise made here and engineered afterwards.

If you want to send the signal anyway, it is built into some browsers and available as an extension for the others, and it is switched on once and then applies to every site you visit. It costs you nothing to turn on and we would rather you had it on than off. The same right can be used by writing to [email protected], and section 12 of the privacy policy sets out every right we give everybody.

Cookies on your own DEVIQO website #

The website we build for you sets only what it needs to work. But most of the useful things a business adds to a site come with storage of their own:

• an online booking calendar, which has to remember which slot you were holding;
• a live chat, which has to remember the conversation;
• an embedded map or video, which the provider will usually mark as a tracking cookie, and which is also one of the heaviest things you can put on a page: why your website is slow, and what it costs you puts a figure on it;
• an analytics tag or a social media pixel, if you ask us to add one.

When any of those goes on, you are the one responsible for telling your visitors and, where consent is required, obtaining it. That is what the law asks of the site owner rather than the host.

We fit a cookie notice to your site as part of the build and we will help you word it. Ask on live chat and we will go through what your particular site sets. A notice of that kind is one of the five pages every small business website needs, and it goes on with the rest of them when our team builds the site.

The law behind this #

The United States has no single rule about storing something on a device, and no federal cookie law. What applies instead is two things. Section 5 of the Federal Trade Commission Act bars unfair or deceptive practices, which is what makes a cookie banner that lies, or a policy that omits a tracker, an enforcement matter rather than a style question. And the state comprehensive privacy statutes apply on top wherever what is stored counts as personal data about you, which for anything with an identifier in it usually means it does.

Those state statutes do not agree with each other, and most of them only reach a business above a size threshold. We do not work out whether we are over the line in your state. We apply the strictest version to everybody. In practice that means three things on this site:

• nothing that is not strictly necessary is stored on your device without your consent, wherever you live, and if that ever changes the bar in section 6 starts doing real work instead of recording an answer;
• refusing is exactly as easy as accepting, in one press, and there is no design here that nudges you toward yes;
• a browser opt-out signal is honored for every visitor, which is section 8.

“Strictly necessary” is narrower than most sites pretend. It means necessary to deliver something you asked for, such as keeping you logged in, remembering a cart or preventing fraud at the checkout. It does not mean necessary for the business, useful for us, or nice to have. Every item in section 3 is measured against that meaning and not the convenient one.

What we do with any personal data is set out in the privacy policy. If you want to complain about any of it, the route is your state attorney general, and in California the California Privacy Protection Agency as well; section 16 of that policy has the detail, and we will point you at the right office for your state if you ask.

Changes to this cookie policy #

This page is checked whenever we change anything about how the site is built, and at least once a year. The table is the part that matters, and it is written from what the code does rather than from a template.

The date at the top of this page is the date it last changed.

Common questions about cookies #

Two of these are about this site. The other four are the ones customers ask about their own, because a cookie banner is one of the few things on a website the law puts squarely on the owner rather than on the company hosting it.