Cookie Policy

Last updated: February 2026

What are cookies?

Cookies are small text files stored on your device when you visit a website. They help websites function properly and provide information to site owners.

Essential cookies

These cookies are required for the website to function and cannot be disabled. They include session cookies for login authentication, CSRF protection tokens, and cookie consent preferences.

Legal basis: Legitimate interest (site functionality)

Analytics & advertising cookies

We use PostHog for product analytics and the Trustpilot SDK to invite reviews after a purchase. We run no advertising cookies and no advertising tags — no Google Ads, no Google Analytics, no LinkedIn, no Meta pixel. Nothing on this site follows you to another one.

Exactly what happens, by visitor:

You send a Global Privacy Control signal, or you have opted out on Do Not Sell or Share, or you chose “Essential Only” and have loaded a page since: none of the three load. Their code is not written into the page at all — you can confirm it yourself: view source on any page and search for googletagmanager, tp.min.js or posthog.init — with an opt-out in effect, none of the three is there.
You are in the EU/EEA, UK or Switzerland and have not yet chosen: PostHog and Trustpilot do not load. Neither has a consent mode, so for them there is no such thing as “loaded but storing nothing” — neither is started until you accept, and PostHog’s code is not written into the page at all. Google’s tag does load, in denied mode under Google Consent Mode v2: it stores no cookies and sets no advertising identifiers, and sends only an anonymous, cookieless signal. Choosing “Accept All” upgrades Google and loads Trustpilot on the spot, and PostHog from your next page onward. Choosing “Essential Only” puts you in the row above from the next page you load. It cannot put you there on the page where you click it: by then Google’s tag has already loaded in denied mode, and a click in your browser cannot un-write a script the server has already sent. What it does on the spot is record the choice for 12 months and hold Google in denied mode, and it starts nothing of its own: refusing never causes a request that would not have happened anyway.
You are outside those countries and have sent no opt-out signal: all three load, as they always have.

This page used to say these cookies were “only loaded after you give explicit consent”. That was not true when it was written — the tags were hardcoded into every page’s <head> and had already run before the banner rendered. The description above is what the code now does, and every line of it is checkable from the page source.

Legal basis: Consent (GDPR Article 6(1)(a))

Providers: PostHog — PostHog Privacy Policy · Google — Google Privacy Policy · Trustpilot — Trustpilot Privacy Terms

Managing your preferences

When you first visit our site from the EU/EEA, you will see a cookie consent banner. You can choose “Accept All” to enable analytics cookies, or “Essential Only” to block them. Your choice is stored for 12 months and applied server-side on every page you load afterwards.

Global Privacy Control. If your browser or an extension sends a Sec-GPC: 1 header, we treat it as an opt-out on every page, everywhere in the world — no banner, no click required. It takes precedence over an “Accept All” choice made here.

To change your preference, click the button below:

Contact

For questions about our cookie practices, contact us at privacy@galaxywarden.com.