Cookie policy

Summary

This page describes the cookies and similar local-storage technologies used on emojery.app: the marketing website. It applies to the website only; the browser extension itself does not set cookies, does not use localStorage beyond its own session keys, and does not load any third-party analytics or advertising SDK.

Cookies on this site fall into 3 groups: strictly necessary preference keys, an aggregated cookieless analytics beacon, and Google Analytics. The first two run by default. The third depends on where your browser says you are: in the EEA, the UK and Switzerland it is set only after you click Accept on the cookie banner; everywhere else it is set on the first page view and no banner is shown. None of these are used for advertising or cross-site tracking.

1. What is a cookie

A cookie is a small text file a website asks your browser to store, so the website can recognize the same browser on a later visit. localStorage is a similar but newer storage mechanism — also a small piece of text, also stored by your browser, but read only by JavaScript (not sent back with every HTTP request like a classic cookie). For the purposes of EU ePrivacy and UK PECR rules, both cookies and localStorage entries count as "storing information on the user's terminal equipment", and both are covered by the same consent requirements.

2. Cookies and storage we use

2.1 Strictly necessary (always on)

3 localStorage entries, each one holding a choice you made so the site does not have to ask again: your answer to the cookie banner, your theme, and which roadmap entries you upvoted. None of them is written before you act, none carries an identifier, and none is sent to a server. They fall under the ePrivacy Art. 5(3) "strictly necessary" exception and do not themselves require consent. The roadmap upvote itself is sent to our server, which records a fixed salted hash of your IP address next to the entry for 365 days so one person cannot upvote it twice; that record lives on the server, not in your browser, and the privacy policy lists it.

2.2 Cloudflare Web Analytics (cookieless, no consent required)

Cloudflare Web Analytics is a server-side aggregation system. The injected beacon reports a page view to Cloudflare's edge with the URL, referrer, viewport size, browser family, and a coarse country derived from your IP. It does not set any cookie, does not write to localStorage or sessionStorage, and assigns no user identifier. Because nothing is stored on your device, ePrivacy Art. 5(3) is not engaged and consent is not required (GDPR legal basis: Art. 6(1)(f) legitimate interest in measuring website health). If you would prefer to be excluded from this layer as well, any standard content-blocker (uBlock Origin, AdGuard, Privacy Badger, Brave Shields) will hide your visit.

Provider: Cloudflare, Inc. (US-headquartered, EU SCCs in place for transfers from the EEA/UK/Switzerland).

2.3 Google Analytics 4 (opt-in via banner in the EEA, UK and Switzerland; on by default elsewhere)

Google Tag Manager loads Google Analytics 4 on this site. GA4 sets 2 first-party cookies that let it count unique visits, sessions, and basic engagement signals. We use these to understand how many people land on the install page, which articles get read, and where traffic comes from. We do not use Google Ads, Google Signals (cross-device audiences), remarketing audiences, or conversion-linker integrations. There is no data sharing with the Google advertising ecosystem.

Whether the cookies are set before you do anything depends on region, and 2 separate things read that region. Whether storage is allowed is Google Consent Mode v2, and Google matches the region from your IP address at its end: from an EEA, UK or Swiss address every storage type starts denied, GA4 still counts the page view in an anonymized, cookieless way, no client-side identifier is created, and the request-level identifier rotates every 24 hours. From any other address consent starts granted and the 2 cookies are set on the first page view.

Whether the banner appears is decided in your browser instead, from the time zone it reports, because the page cannot see what Google resolved your IP to. The 2 can disagree: a European time zone on a non-European connection shows the banner over a visit Google already treats as consented, and a non-European time zone on a European connection shows no banner over a visit Google keeps denied until it gets one. The banner errs toward appearing — a browser that reports no usable time zone is treated as European.

Outside the EEA, the UK and Switzerland there is no in-page switch to refuse the cookies. The ways to refuse them are the browser-level ones in section 4: block googletagmanager.com with a content blocker, disable third-party scripts for this site, or clear the cookies after a visit. We are aware this is a weaker control than a banner and it is listed as such on the privacy page.

Provider: Google LLC and Google Ireland Limited (US/EU; Standard Contractual Clauses for international transfers).

2.4 Cloudflare Turnstile (2 pages only, no consent required)

The API waitlist form and the uninstall survey are the only 2 pages that load Cloudflare Turnstile, the check that tells a person from a script before a form is accepted. It runs only on those 2 pages, only because a form is on them, and it is not loaded anywhere else on this site. Turnstile may store a short-lived value on your device to avoid re-challenging you; that storage is strictly necessary to deliver a service you asked for by submitting the form, so ePrivacy Art. 5(3) exempts it from consent. It carries no analytics purpose and is not used to profile you.

Provider: Cloudflare, Inc. (US-headquartered, EU SCCs in place for transfers from the EEA/UK/Switzerland).

3. Cookies we deliberately do not use

• No advertising cookies, no Google Ads cookies, no Meta Pixel, no LinkedIn Insight Tag, no TikTok Pixel.
• No remarketing or "Looking-Alike Audiences" pixels.
• No Hotjar, FullStory, Mouseflow, or any other session-replay / heatmap tool that records what you do on the page.
• No A/B testing SDKs that store experiment variants in your browser.
• No chat widgets that drop a third-party cookie just by loading.

4. How to change your mind

You can change your decision at any time. 2 practical paths:

1. Clear site data for emojery.app in your browser settings (DevTools → Application → Clear storage on Chromium; or Preferences → Privacy → Clear data for this site on Firefox). Both the GA cookies and the emojery-consent-v1 preference will be removed, and the banner will reappear on next visit where the banner applies; elsewhere the cookies are set again on the next page view unless you block the analytics script.
2. Use your browser's built-in cookie management (Settings → Privacy → Cookies and site data) to delete only _ga* entries for emojery.app while keeping the consent preference. The site will keep your "accepted vs declined" choice and not show the banner again, but GA will start fresh on the next page load.

Browser-level controls such as Global Privacy Control (GPC), "Do Not Track", or content-blocking extensions like uBlock Origin also work as expected. We do not override or ignore those signals.

5. The browser extension

To be explicit: this cookie policy covers only the marketing website emojery.app. The browser extension itself, the thing you install in Chrome / Firefox / Edge to leave reactions, does not load Google Analytics, Google Tag Manager, Cloudflare Web Analytics, or any other tracker. It uses local browser storage (chrome.storage and IndexedDB) to hold your session token, settings, and the offline vote queue. These are not cookies and never leave your device.

For the full extension data story, see the privacy policy.

6. Contact and updates

For cookie-specific questions, open an issue on GitHub. We will revise this page whenever the cookie inventory changes, whether added, removed, renamed, or lifetime adjusted, and the "Last updated" date at the top will reflect the most recent change.