Cookies and measurement - DomainDrift

DRM3 Labs Corp. · Version 1.1 · Effective August 2, 2026

DomainDrift measures how the product is used with three tools, and they are not

the same kind of thing. Two are ours or set nothing on your device. One, Google

Analytics, is a third party that sets its own cookies, and it does not load at all

until you say yes. We run no advertising and we sell none of this. This page lists

every tool, every cookie and every field, so you can check the list against what

your browser actually shows.

Your choice

Google Analytics never loads until you press Accept or OK, wherever you are.

Not "loads and waits": the script tag is not in the page, and your browser makes no

request to Google, until you have agreed. If you never answer the notice, you are

never measured by Google.

If you are in the UK, the EEA, or Switzerland, nothing non-essential is stored

and no usage event is sent until you press Accept. If you press Decline,

we store nothing, send nothing, and remember only that you declined.

Everywhere else, our own measurement runs with the notice shown, and Opt out

turns it off, deletes the identifier, and blocks Google Analytics.

To change your mind, use the "Privacy choices" link in the footer of any page.

It reopens the same notice with the same two buttons. Clearing site data for

`domaindrift.io` also resets the choice.

If you withdraw consent after having given it, we switch Google Analytics off using

Google's own opt-out mechanism and delete its cookies from your browser. A script

that has already loaded cannot be unloaded, so it stops collecting rather than

disappearing; from that moment it sends nothing.

Your choice is recorded in `localStorage` under `dd_consent`, not in a cookie, so

declining leaves nothing in your cookie jar.

Cloudflare Web Analytics is not covered by the notice because there is nothing to

cover: it sets no cookie and stores nothing in your browser. We would rather say

that plainly than imply that opting out stops something it does not stop.

Cookies

That is the complete list. DomainDrift sets no advertising cookies. The two Google

cookies above are the only third-party cookies on this site, they appear only after

you accept, and the advertising and remarketing features of Google Analytics are

switched off in our configuration, so they are not used to build an advertising

profile of you through us.

Browser storage that is not a cookie

What a usage event records

When measurement is active, an event carries:

What is never recorded in OUR events: your IP address, your full user agent

string, any query string, form contents, search terms you typed, anything you

enter into the probe tool, or any content of a page you visited elsewhere.

We do not record keystrokes and we do not capture or replay your screen. The heat

map above is built from click POSITIONS only. There is no recording of a session

to play back, and mouse movement is not tracked at all. We use no session-recording

product.

What Google Analytics records, if you accept

Google Analytics is a separate collection from the one above, held by Google rather

than by us, and it is honest to say that its floor is different from ours. When it

is running it receives your IP address and your full user agent the way any

request to Google does, plus the page you are on, where you came from, an approximate

location derived from the IP, and the two cookies listed above.

Two things we do control, and do:

• We configure it to report the page path only, never the query string, so the

same rule that governs our own events governs what we hand Google.

• We turn off Google signals and ad personalization signals, which are the

settings that would join your visit to Google's advertising graph.

### If you are signed in: the account identifier

If you are signed in to your DRM3 account and you have accepted, we also send

Google a pseudonymous account identifier. It is the opaque reference your DRM3

account already has internally, and nothing else.

• It is not your email address, your name, or your username, and it cannot be

turned back into any of them by Google or by anyone else holding it.

• What it is for: DomainDrift is one of several DRM3 apps, and Google Analytics

otherwise counts the same person as a different person on each app, because its

cookie is tied to a single website. The identifier lets us see that one person used

two apps rather than that two people each used one. We use it to understand how the

apps are used together. It is not used to build a profile for advertising, and the

advertising features are switched off.

• If you are signed out, none of this applies. No identifier is sent, and the same

is true if you have not accepted, because nothing is sent to Google at all.

• Signing out stops it. So does withdrawing consent.

We do not use Google Analytics' advertising or remarketing features, and we run no

advertising anywhere on this site.

Retention

• Our raw events: 90 days. Deleted automatically on a scheduled job.
• Our daily totals: kept indefinitely. These are aggregate counts per day with

no identifier attached, and they are what we use to understand the product over

time.

• Google Analytics: 14 months. That is the retention period set on the property,

and it is the longest a standard Google Analytics property allows. Google's own

aggregate reporting continues past it. Deletion of Google-held data is requested

through Google, and we will make that request on your behalf if you ask us.

Why we measure

To answer questions we cannot otherwise answer: whether anyone is finding the

product, which pages they read, where they stop, whether the thing they clicked

worked, and whether a link we posted somewhere actually brought anybody. Without

this we cannot tell the difference between a product nobody has found and a

product nobody wants, and those two problems have opposite fixes.

Third parties

Google Analytics 4 (Google Ireland Limited / Google LLC). Loaded only after you

accept. It processes the data described above as our processor, under Google's

data processing terms for Google Analytics; we are the controller and we decide what

it collects. Data may be processed in the United States, which Google covers by

Standard Contractual Clauses and its EU-US Data Privacy Framework certification.

Google Fonts (`fonts.googleapis.com`, `fonts.gstatic.com`). Your browser's

request for the font files discloses your IP address and user agent to Google. This

is not measurement, it is not consent-gated because it is what makes the page

readable, and we receive nothing back from it.

Cloudflare Web Analytics, plus Cloudflare as our hosting and network provider,

which necessarily processes traffic to this site as a service provider. The

analytics part is cookieless and sets nothing on your device.

That is the complete list of third parties that receive anything when you load a

DomainDrift page. None of them is an advertising network, and we sell nothing to any

of them.

Your rights

To ask what is held about you, to have it deleted, or to object, write to

support@drm3.io. Because the identifier is anonymous, you may need to tell us

your `dd_uid` value (readable in your browser's cookie inspector) for us to find

anything, or simply clear site data, which removes the identifier and leaves the

remaining events unlinkable to you.

For data held by Google Analytics, tell us and we will raise the deletion request

with Google. Withdrawing consent through the footer link stops further collection

immediately and removes Google's cookies from your browser.

Domain owners: this page is about visitors to the website. Removing a domain

from scanning is a different process, at

drm3.io/publisher-opt-out.

See also the Privacy notice and the

Terms of use.