Privacy policy
This policy describes how Stackdrop handles personal data on this website. The short version: reading the site needs no account, we tell you exactly what runs in your browser, and you can switch the measurement off at any time from any page.
Who we are
Stackdrop operates this website. Questions about this policy go to hello@stackdrop.co.
What we collect
Reading this site requires no account. Four things process data while you browse:
- Hosting. Our hosting provider (Vercel) processes technical request data — IP address, user agent, requested URL — to serve pages and protect against abuse.
- Performance measurement. Vercel Speed Insights collects anonymous page-timing metrics (Core Web Vitals). It sets no cookies.
- Error monitoring. When a page breaks, Sentry receives the error, the URL, and browser metadata so we can fix it. Cookies and identifying headers are stripped before the report is sent, and there is no session recording.
- Analytics and advertising measurement. Google Analytics 4, loaded through Google Tag Manager, plus the LinkedIn Insight Tag for our LinkedIn campaigns. This is the part your consent choice governs — see below.
Cookies and local storage
Strictly necessary. These two are set regardless of your consent choice, because they are what makes the choice work:
| Name | Purpose | Lifetime |
|---|---|---|
sd_consent | Records the consent choice you made, so we stop asking | 180 days |
sd_country | Your two-letter country code, to apply the right consent rules | 7 days |
Measurement and advertising. Set by Google once the matching consent signal is granted:
| Name | Purpose | Lifetime |
|---|---|---|
_ga, _ga_* | Google Analytics: distinguishes visitors and sessions | 2 years |
_gid | Google Analytics: legacy visitor identifier, if present | 24 hours |
_gcl_* | Google Ads: links an ad click to what you did on the site afterwards | Up to 90 days |
Lifetimes for the Google cookies are Google’s own defaults; the cookies are theirs, not ours. The LinkedIn Insight Tag sets its own cookies under linkedin.com while advertising consent is in place; LinkedIn documents those.
Your light or dark theme preference is not a cookie: it lives in your browser’s local storage under the key theme and is never sent to a server.
How consent works where you are
Google Tag Manager loads for every visitor, before any choice is made. What changes by region is what the tags inside it are permitted to do, expressed as four Google Consent Mode signals: analytics storage, ad storage, ad user data, and ad personalization.
- EEA, UK, and Switzerland.All four start denied. Nothing is stored on your device and no identifiers are collected until you accept. Google’s tags still send cookieless pings — no identifiers, nothing written to your browser — which lets us see aggregate campaign performance without tracking you.
- Everywhere else. All four start granted: measurement and advertising cookies are set on your first page view, before you interact with anything. The banner says so plainly, and the opt-out next to it takes one tap.
If we cannot tell where you are, we apply the stricter EEA rules. Accepting grants all four signals; declining or opting out denies all four. There is no hidden middle setting.
How we know which rules apply
At the edge, before the page is served, we read the country code our host derives from your IP address and store that two-letter code in the sd_country cookie. We never store or log the IP address itself, and we never send it to a third-party geolocation service. The only purpose is choosing the correct consent regime, which is why this cookie counts as strictly necessary.
Change or withdraw your choice
— in the footer of every page, and right here — reopens the banner with your current choice selected. Withdrawing consent does two things:
- Denies all four signals, so no further data is collected.
- Deletes the Google analytics and advertising cookies already on this browser (
_ga,_ga_*,_gid,_gcl_*). Denying a signal alone does not remove what is already stored, so we clear it.
Withdrawing is exactly as easy as consenting: the same control, the same two options. We remember your choice for 180 days and then ask again; we also ask again if what we are asking about changes.
Do Not Sell or Share My Personal Information
We do not sell personal information for money. We do run Google Ads and LinkedIn Ads campaigns, and while the advertising signals are granted, the measurement described above can count as sharing personal information for cross-context behavioral advertising under several US state privacy laws.
To opt out, use and choose to opt out. The effect is the withdrawal described above: the advertising signals are denied and the advertising cookies on this browser are deleted. We also honor Global Privacy Control as a valid opt-out signal, without asking you to click anything.
Global Privacy Control
If your browser or extension sends Global Privacy Control, we deny the three advertising signals — ad storage, ad user data, ad personalization — on every page load, in every region, whatever the banner would otherwise do, and delete advertising cookies already set. First-party analytics stays governed by your own choice.
We do not store the GPC signal. It is read fresh on each page load and it does not overwrite a choice you made: turn GPC off and your stored choice applies again.
Who we share data with
- Google — Google Analytics 4 and Google Ads measurement, delivered through Google Tag Manager.
- LinkedIn — the Insight Tag, which runs only while advertising consent is granted.
- Vercel — hosting and anonymous performance metrics.
- Sentry — error reports, with personal data stripped.
Contact by email
If you email us, we keep the correspondence for as long as needed to handle your request and our legitimate business records.
Your rights
You can request access to, correction of, or deletion of personal data we hold about you by writing to hello@stackdrop.co. For anything cookie- or advertising-related, the fastest route is the control above: it takes effect immediately, in your browser.
Changes
This policy is updated whenever what the site actually does changes. Last updated 27 July 2026.