Effective: July 2026 · Last updated: September 2026
This page explains what cookies and similar browser-storage technologies grumpycapy.com — operated by Data Sauna LLC, a Wyoming (USA) limited liability company — uses, the legal basis for each, and how you can control them. Read it together with our Privacy Policy. Short version: the site runs on a few strictly-necessary, first-party storage entries plus two cookieless traffic counters. We also use optional analytics and advertising tools, most of which load only after you accept cookies in the banner. The one exception is Google AdSense, which serves the ads that pay for the site: it runs for every visitor, but requests non-personalized ads unless you accept.
When you first visit, a banner asks you to accept or reject non-essential cookies. Pressing Accept is what turns on Google Analytics' cookie-based mode, Microsoft Clarity, and the Meta Pixel — none of those store anything on your device before that. Two things run either way: Google Analytics in its cookieless "consent denied" mode, and Google AdSense in non-personalized mode (see section 2, "Advertising"). If you press Reject, or ignore the banner, that is all that runs, alongside the strictly-necessary storage and the cookieless counters. You can change your mind at any time using the Cookie settings link in the footer (see section 5).
If you are visiting from the EEA, the UK, or Switzerland, you will see Google's consent message instead of our banner — one prompt, not two. Google's message is a certified consent management platform, and in those regions it is the record that governs everything described below, including our own analytics. Section 2 has the detail.
1. What cookies are
Cookies are small text files placed on your device by a website. Similar technologies include localStorage, sessionStorage, pixels, and SDKs. Under the EU ePrivacy Directive, the UK Privacy and Electronic Communications Regulations (PECR), and similar laws elsewhere, storing or accessing information on a user's device generally requires either prior consent or the "strictly necessary" exemption.
2. Cookie and storage categories on grumpycapy.com
Strictly necessary (no consent required)
These are first-party entries set by grumpycapy.com itself — two in localStorage, one cookie. None contain an email, a name, or an identifier that works on any other site.
| Name | Type | Purpose | Duration |
|---|---|---|---|
cookie-consent | localStorage | Stores whether you accepted or rejected non-essential cookies, so we honor your choice and don't ask again. Contains the word granted or denied only. | Persistent (until you clear browser data) |
gc_popup_shown_at | localStorage | Timestamp of when we last showed you the quiz popup, used to make sure we don't show another for a while. A number only — no identifier. | Rolling (overwritten on next eligible popup) |
gc_v | Cookie (first-party, HttpOnly, SameSite=Lax) | Set the first time you vote on the Spotted wall. Holds a random identifier so the same person can't vote twice on one sighting and so the five-votes-a-day limit can be counted. It contains no name, email, or anything that identifies you, it is not readable by scripts, and it means nothing on any other website. Clearing it gives you a new identifier and a fresh set of votes. | 1 year |
Legal basis: strictly necessary for the functioning of the site as requested by you (Article 5(3) ePrivacy Directive exemption; "necessary" processing under Article 6(1)(f) GDPR for the underlying personal-data aspect). cookie-consent and gc_popup_shown_at contain no identifier at all. gc_v contains a random one, which is what makes one-vote-per-person possible without asking you to create an account — it is set only once you press a vote arrow, which is the "service explicitly requested" the exemption turns on.
Bot protection on the submission form (no consent required)
The form at /spotted/submit is protected by Cloudflare Turnstile, which checks that a submission comes from a person rather than a script. It loads only on that page — not on the wall, not on articles, not anywhere else — and only when you open the form. The check runs against challenges.cloudflare.com and may read or write storage on that domain; Cloudflare states that Turnstile does not use what it collects for behavioral advertising or cross-site tracking, which is why we run it rather than reCAPTCHA. See Cloudflare's privacy policy. Legal basis: strictly necessary for the security of a public upload form (Article 5(3) exemption; legitimate interest in fraud and abuse prevention under Article 6(1)(f) GDPR).
Cookieless analytics (no consent prompt required)
We use two cookieless tools that run for every visitor to measure aggregate traffic: Vercel Analytics and Cloudflare Web Analytics. Neither sets cookies, localStorage, or sessionStorage, and neither uses a device identifier or fingerprint. They collect anonymized page-view metadata (page URL, referrer, country, device type, browser). Because nothing is stored on or read from your device, the ePrivacy Article 5(3) consent requirement does not apply. Lawful basis: legitimate interest under Article 6(1)(f) GDPR.
Analytics
Google Analytics 4 runs for every visitor, but by default — before you accept — it operates in a cookieless "consent denied" mode under Google Consent Mode v2: it sets no cookies and uses no persistent identifier, sending only anonymized, aggregated pings. It sets the cookies below and enables full measurement only after you accept. Microsoft Clarity (heatmaps and session replay) does not load at all unless you accept; when it does, text you type is masked by default.
| Provider | Purpose | Typical storage | More info |
|---|---|---|---|
| Google Analytics 4 (Google) | Aggregate audience and traffic measurement — pages viewed, referrers, rough location, device. | First-party cookies (e.g. _ga, _ga_*), up to ~2 years — set only after consent. | Google privacy |
| Microsoft Clarity (Microsoft Corp.) | Aggregate heatmaps and session replay to see how pages are actually used. Typed text is masked by default. | First-party and Microsoft cookies (e.g. _clck, _clsk), up to ~1 year. | Microsoft privacy |
Advertising
Google AdSense serves the display ads that pay for the site, so its script loads for every visitor, before and regardless of your cookie choice. Until you accept, we set Google's requestNonPersonalizedAds flag and Google's Consent Mode v2 signals for ad storage, ad user data, and ad personalization are all set to denied. That means non-personalized ads: selected from general context — roughly the page you are on and your approximate location — rather than a profile of your browsing history. Non-personalized does not mean storage-free. Google can still set cookies and read device storage, including first-party cookies on grumpycapy.com, for frequency capping, ad measurement, and invalid-traffic detection. Accepting cookies upgrades AdSense to personalized ads from your next page view onward.
Google's consent message (EEA, UK, Switzerland). Google requires publishers to use a certified consent management platform before serving personalized ads to visitors in those regions, so we use Google's own. If you are in the EEA, the UK, or Switzerland, Google shows you its own message — with Consent, Do not consent, and Manage options — and our own banner stays hidden, so you get one prompt rather than two. Google's message records your choice in the industry-standard IAB Transparency and Consent Framework (TCF v2.2), and we read that same signal to decide whether to run our analytics tools: Google Analytics' cookie-based mode and Microsoft Clarity follow your consent for storing information on your device and measuring content performance, and the Meta Pixel follows your consent for advertising purposes. In other words, in those regions Google's message governs everything on this page, not just ads. Visitors elsewhere in the world do not see it and use our banner instead.
If you accept cookies, we may also load the Meta (Facebook) Pixel so we can measure whether our social posts and ads bring people to the site, and reach similar audiences. It sets cross-site advertising cookies and does not load unless you accept.
| Provider | Purpose | Typical storage | More info |
|---|---|---|---|
| Google AdSense (Google) | Serving display ads, capping how often you see the same ad, measuring ad performance, and detecting invalid traffic. | First-party cookies set on grumpycapy.com by the AdSense script (e.g. __gads, __gpi), typically up to ~13 months, plus Google cookies on google.com / doubleclick.net (e.g. IDE, test_cookie) and browser storage on Google's own domains. Some of these are set before you make a cookie choice, including in non-personalized mode. | Google ads & cookies |
| Meta Pixel (Meta Platforms) | Conversion measurement and audience building for Facebook / Instagram campaigns. | Cross-site cookies (e.g. _fbp), up to ~3 months. | Meta privacy |
Legal basis: for anything that stores cookies or data on your device — Google Analytics after you accept, Microsoft Clarity, the Meta Pixel, and personalized ads through Google AdSense — your consent (Article 6(1)(a) GDPR and the Article 5(3) ePrivacy consent rule). Google Analytics' cookieless "consent denied" pings rely on our legitimate interest under Article 6(1)(f). Consent is optional, and you can withdraw it at any time (section 5). You can also manage Google's ad settings directly at My Ad Center, and opt out of many third-party vendors' use of cookies for personalized advertising at aboutads.info/choices or youronlinechoices.eu.
Where this setup is limited. Ad serving reads and writes information on your device even in non-personalized mode, and the AdSense script runs before you make a choice. In the EEA and UK, a strict reading of the ePrivacy consent rule would require consent for that too, not only for personalization. We would rather say this plainly than imply a stricter gate than the one that exists. If you do not want any ad-related storage, block third-party cookies and scripts for this site in your browser, or use an ad blocker — nothing on the site is gated behind seeing ads.
Embedded content (Instagram)
A few pages embed public posts from Instagram — for example, a venue's own Instagram in our capybara-encounters directory. Each embed is an iframe that loads directly from Instagram's servers; we run no Instagram script on our own pages. Instagram can still set its own cookies and read or write browser storage on instagram.com when the embed loads. Because an embed is part of the content you came to view, it can load before you make a cookie choice — it is not part of our consent-gated analytics or advertising stack. If you would rather Instagram not load, block third-party cookies or third-party content in your browser, or avoid pages that show an embed.
| Provider | Purpose | Typical storage | More info |
|---|---|---|---|
| Instagram (Meta Platforms) | Displaying embedded Instagram posts on certain pages. | Instagram / Meta cookies set on instagram.com when the embed loads. | Instagram privacy |
3. Third-party cookies on this domain
Apart from Google AdSense — described in section 2, which can set its own first-party cookies on grumpycapy.com (for example __gads and __gpi) as soon as an ad loads — no third-party tool sets cookies on this domain unless you accept non-essential cookies. If you accept, the analytics and advertising tools above (Google, Microsoft, Meta) may set their own cookies. Fonts are self-hosted from our own server, so no requests are made to Google Fonts or any other font CDN.
Our hosting provider (Vercel), our database, file, and form provider (Supabase), the affiliate marketplaces we link to (Amazon, Etsy), Google (ad serving through AdSense, including in non-personalized mode), Cloudflare (the Turnstile check on the submission page only), and Instagram (on pages that show an embedded Instagram post) may set cookies on their own domains in connection with their services, but those cookies are not set on, nor accessible from, grumpycapy.com. See their respective policies:
- Vercel cookie policy
- Supabase privacy policy
- Cloudflare privacy policy (Web Analytics, and Turnstile on the submission form)
- Instagram privacy policy
- How Google uses cookies in advertising
4. About the cookie banner
The banner is a genuine consent gate for Google Analytics' cookie-based mode, Microsoft Clarity, and the Meta Pixel: press Accept and we record your choice in cookie-consent and load them; press Reject, or ignore the banner, and they never load. It is not a gate for Google AdSense. The AdSense script loads for every visitor either way, because it serves the ads that pay for the site — what the banner controls is whether those ads are personalized. Rejecting keeps them non-personalized; it does not remove them, and it does not stop Google from setting ad-serving cookies for frequency capping, measurement, and invalid-traffic detection. You can revisit this choice at any time using the Cookie settings link in the site footer.
It is also not a gate for the two strictly necessary items above. Your vote identifier and the Turnstile check are not advertising or analytics: the first exists so the wall can count one vote per person, the second so the submission form is not filled by scripts. Neither profiles you, neither follows you to another site, and neither appears until you vote or open the form.
In the EEA, the UK, and Switzerland this banner does not appear at all — Google's certified consent message takes its place, and your answer there drives the same tools. The Cookie settings link in the footer re-opens whichever prompt applies to you.
We also treat a Global Privacy Control (GPC) signal from your browser as an overriding opt-out. When GPC is present we keep advertising non-personalized and do not load the consent-gated tools, whatever was chosen on this device before, and on every page load.
5. How to control or remove cookies and storage
You can clear cookies and localStorage at any time through your browser settings. Clearing this site's cookies also clears gc_v, which resets which sightings you have voted on and gives you a fresh daily allowance. Most browsers also let you block first-party or third-party cookies entirely; this may affect functionality on other sites you visit.
To withdraw consent for the analytics and advertising tools, use the Cookie settings link in the site footer at any time. It re-opens whichever prompt applies to you: our banner in most of the world, or Google's consent message in the EEA, the UK, and Switzerland. (You can also clear this site's cookies and localStorage in your browser, which removes the cookie-consent flag and brings the banner back.) Withdrawing downgrades Google Analytics to its cookieless mode and stops Microsoft Clarity and the Meta Pixel from loading on future visits.
We also honor the Global Privacy Control (GPC) signal as a valid opt-out request for the sale/sharing of personal information, consistent with applicable law. You can enable GPC in a supporting browser or extension.
6. Changes to this policy
We'll update this policy if our use of cookies or similar technologies changes. The "Effective" and "Last updated" dates at the top show when it was last revised.
7. Contact
Questions about cookies, tracking, or privacy? Reach us through the contact page or use the social links in the footer.