Cookie policy

This page is a list, not an essay.

What this website stores

Two things can end up in your browser here, and only one of them is a cookie.

The first is not a cookie and does not depend on your answer: a single entry named gw-cookie-choice holding either all or necessary, which IS your answer. It stays on your device, it is never sent to us, and it exists so the banner does not ask you twice.

The second is a cookie and depends entirely on your answer: Google Ads sets one only if you accept. Choose Necessary only, or close the banner without answering, and it sets nothing — the tag still loads, but in the denied state described in the next section, where it may not store or read anything on your device. There is no sign-in cookie, no preference cookie and no session cookie on this website, because there is no sign-in, no basket and no session.

They store exactly one thing in your browser, and it is not a cookie. It is a single entry named gw-cookie-choice holding either all or necessary, which is the answer you gave the banner. It stays on your device, it is never sent to us, and it exists so that the banner does not ask you twice.

Everything these pages are made of is served from this site: the fonts, the icons, the pictures. Exactly two things load from another company into your browser, both from Google or Cloudflare and both with their own section below — the advertising measurement tag, and the bot check on our request form. Nothing else here can see you, and nothing here builds a profile of you across other websites.

Strictly necessary

The banner's first row, always on, no switch.

On this website there is currently nothing in this category, because there is nothing to keep: no sign-in, no basket, no session. The row has no switch because anything genuinely strictly necessary is there whether you like it or not, and a switch that cannot change the outcome is a fake choice.

Inside the Gridwork app this category is real, and it is listed further down.

Advertising measurement

The banner's second row, the one with the switch. It used to control nothing and this page said so in as many words. It controls Google Ads now, and this section is what it controls.

We advertise, and we would like to know which ad brought somebody here rather than guessing. The tag is Google Ads, account AW-18423507753, and it is the only third party on these pages besides the bot check.

It loads on every page, and what it is ALLOWED to do depends entirely on your answer. Before you answer, and for ever if you choose Necessary only, it runs in what Google calls consent mode with everything denied: it sets no cookie, stores no identifier, and reads nothing already on your device. It sends Google a request with no identity attached to it, and Google estimates the rest. We would rather have an estimate than a cookie you did not agree to.

If you accept, it sets its own cookies — Google names them _gcl_au and, on some visits, _gcl_aw and _gcl_gb — which last up to 90 days and let Google join your visit to the ad you clicked. Google receives your IP address, your user-agent and the page you are on, under its own privacy notice.

It is measurement, not retargeting. We do not build audiences from this site and we run no remarketing list off it. If that ever changes, this paragraph changes first.

Changing your mind costs nothing and the last section says how.

Inside the app we do measure product usage, and it is deliberately blunt. It counts events and times how long things take. It captures no clicks, no automatic page views, no session recordings and no personal profiles, because the app has a customer’s business written across the screen and a recorder pointed at that would be a leak wearing a measurement label.

The bot check on our forms

Our request form is protected by Cloudflare Turnstile. It is the second of the two third parties on this site, and unlike the first it runs whatever you answered the banner — a check that a consent choice could switch off would not be a check.

Cloudflare receives your IP address, your browser fingerprint, your user-agent string and our public site key. It hands back a pass or a fail. Its challenge system may set cookies of its own in your browser while the check runs, and Cloudflare treats those as strictly necessary for telling a person from a script. We do not use the pre-clearance mode, which is the setting that would leave a longer-lived clearance cookie behind after the check.

Cloudflare's own privacy notice for this product sets out what they do with all of that.

If you block it, the form will not submit, because without the check we cannot tell you apart from a script. That is deliberate and it is not the end of the road: email hello@bygridwork.com and we will take your request that way instead.

Inside the Gridwork app

The app is a different thing from this website, and it does use cookies.

• Sign-in: a session cookie set by our authentication provider so the app knows it is still you from one page to the next. Strictly necessary. Blocking it signs you out.
• Security: cookies that stop another website forging a request in your name. Strictly necessary.
• Preferences: small values remembering how you left the interface, such as which view you were on and your time zone.
• Product analytics: as described above, and switchable in your account settings.

Blocking the strictly necessary ones does not make the app worse, it stops it working. In particular an approval cannot be recorded, and an approval that cannot be attributed to a person is the one thing Gridwork must never have.

What we never use

• No advertising cookie unless you accepted one. Google Ads is the only advertising network here, it is described above, and it is denied until you say otherwise.
• No retargeting and no audience building. We measure which ad worked; we do not follow you around afterwards.
• No data brokers. Nobody buys a list from us and we buy none from anyone.
• No fingerprinting of our own. The bot check reads a browser fingerprint, that belongs to Cloudflare, it is there to tell a browser from a script, and it does not build a profile of you.
• No session recording, on the website or in the app.

Changing your mind

On this website, the button below reopens the banner. Withdrawing is one press and it takes effect immediately: the advertising tag drops straight back to denied and stops being allowed to store or read anything, whether or not you reload.

Change your cookie choice

What that does NOT do is reach into your browser and delete a cookie Google already set — a page cannot reliably remove another company’s cookie, and pretending otherwise would be the kind of claim this page exists to avoid. To clear what is already there, clear the site data for this site in your browser. Withdrawing stops anything new; clearing removes what is old. Doing both is the complete answer.

Blocking browser storage altogether is fine too. The banner will simply ask on every visit, because it could not remember your answer, which is the correct way for that to fail.

In the app: the measurement choice is in your account settings and turning it off costs you nothing. The strictly necessary cookies cannot be switched off from inside the app, because there is no version of it that works without knowing who is signed in. Blocking them in your browser signs you out.

If you want something removed and cannot find how, email hello@bygridwork.com and a person will do it. Data deletion sets out every route, including the ones that are not cookies.

Where this sits with the others: the privacy policy says what we collect and who else sees it, and the terms of use say what you and we each agree to. The banner links here, this page links to both, and data deletion says how to make us delete what any of them describes.