Internal

Privacy Audit Summary

Last privacy review: June 1, 2026

Cookies set by this site

  • None set directly by application code.
  • Cloudflare Turnstile may set short-lived bot-protection cookies on the /contact page only. Strictly necessary.

Local storage used by this site

  • dwc-cookie-consent-v2: stores the visitor's consent choices (analytics, marketing, personalization flags, GPC state, timestamp). Strictly necessary.

Third-party scripts loaded

  • Cloudflare Turnstile (challenges.cloudflare.com): bot protection on contact form. Strictly necessary. Loaded only on /contact.

Scripts requiring consent

  • None at this time. All future non-essential scripts must be added through the centralized consent manager in src/components/cookie-consent.tsx and gated on the appropriate consent category.

Consent storage

Consent choices are stored in browser localStorage under the key dwc-cookie-consent-v2. The consent manager emits a dwc-consent-changed window event that future script loaders must subscribe to.

Global Privacy Control

GPC is honored. When navigator.globalPrivacyControl === true, the marketing category is forced off and the banner displays a notice acknowledging the signal.

Confirmations

  • Google Analytics is not used.
  • Meta Pixel is not used.
  • TikTok Pixel is not used.
  • Google Ads remarketing is not used.
  • Microsoft / Bing Ads tracking is not used.
  • Session replay, heatmaps, mouse tracking, scroll tracking, and behavior recording are not used.
  • Fingerprinting scripts are not used.
  • No chat widget is installed.
  • No non-essential cookies are set before consent.
  • Form contents are not sent to analytics or advertising platforms.