Skip to content
For Business
GalaxyWarden
Menu
Run my free scanFree scan

Cookie Policy

Last updated: October 2026

What are cookies?

Cookies are small text files stored on your device when you visit a website. They help websites function properly and provide information to site owners.

Essential cookies

These cookies are required for the website to function and cannot be disabled. They include session cookies for login authentication, CSRF protection tokens, and cookie consent preferences.

Legal basis: Legitimate interest (site functionality)

Analytics & advertising cookies

We use PostHog for product analytics and the Trustpilot SDK to invite reviews after a purchase. We run no Google Ads tag, no Google Analytics, no LinkedIn Insight tag and no Meta pixel. We do serve Google AdSense, and only on public pages — our breach-news site recentbreaches.com and, on galaxywarden.com, the blog, the security guides and the free Steam account value calculator. AdSense sets advertising cookies on those pages and may personalise what it shows. On galaxywarden.com it is never loaded on a page that shows scan results, on checkout, on your dashboard or account pages, or for a signed-in paying customer (for a one-time purchase, while signed in with the verified email address you paid with), and the free scan box on those pages opens your results on a separate page without ads, so it never sees a scan result, a credential or a removal profile. If you send a Global Privacy Control signal, have opted out on Do Not Sell or Share, or chose “Essential Only”, AdSense is told to show you non-personalised ads only. In the EU/EEA, UK and Switzerland, AdSense on galaxywarden.com does not load at all until you choose “Accept All”.

Exactly what happens, by visitor:

  • You send a Global Privacy Control signal, or you have opted out on Do Not Sell or Share, or you chose “Essential Only” and have loaded a page since: none of the three load. Their code is not written into the page at all — you can confirm it yourself: view source on any page and search for googletagmanager, tp.min.js or posthog.init — with an opt-out in effect, none of the three is there.
  • You are in the EU/EEA, UK or Switzerland and have not yet chosen: PostHog and Trustpilot do not load. Neither has a consent mode, so for them there is no such thing as “loaded but storing nothing” — neither is started until you accept, and PostHog’s code is not written into the page at all. Google’s tag does load, in denied mode under Google Consent Mode v2: it stores no cookies and sets no advertising identifiers, and sends only an anonymous, cookieless signal. Choosing “Accept All” upgrades Google and loads Trustpilot on the spot, and PostHog from your next page onward. Choosing “Essential Only” puts you in the row above from the next page you load. It cannot put you there on the page where you click it: by then Google’s tag has already loaded in denied mode, and a click in your browser cannot un-write a script the server has already sent. What it does on the spot is record the choice for 12 months and hold Google in denied mode, and it starts nothing of its own: refusing never causes a request that would not have happened anyway.
  • You are outside those countries and have sent no opt-out signal: all three load, as they always have.

This page used to say these cookies were “only loaded after you give explicit consent”. That was not true when it was written — the tags were hardcoded into every page’s <head> and had already run before the banner rendered. The description above is what the code now does, and every line of it is checkable from the page source.

Legal basis: Consent (GDPR Article 6(1)(a))

Providers: PostHog — PostHog Privacy Policy · Google — Google Privacy Policy · Trustpilot — Trustpilot Privacy Terms

Managing your preferences

When you first visit our site from the EU/EEA, you will see a cookie consent banner. You can choose “Accept All” to enable analytics cookies, or “Essential Only” to block them. Your choice is stored for 12 months and applied server-side on every page you load afterwards.

Global Privacy Control. If your browser or an extension sends a Sec-GPC: 1 header, we treat it as an opt-out on every page, everywhere in the world — no banner, no click required. It takes precedence over an “Accept All” choice made here.

To change your preference, click the button below:

Contact

For questions about our cookie practices, contact us at privacy@galaxywarden.com.