Legal and privacy
Cookie and analytics notice
This is the complete list. Every row below is generated from the code that runs this site, so if the site starts storing something new, this page changes with it — it cannot be quietly left behind.
What is switched on right now
Optional analytics is currently switched off entirely on this deployment. Nothing in the Analytics rows below is being collected from anyone at the moment, regardless of consent. The rows are published anyway so you can see what the system is capable of before it is ever turned on.
Three independent switches all have to be on before a single event can be stored: the consent platform must be built in, a server-side ingestion switch must be on, and a storage location plus a secret key must be configured. Any one of them turns collection off immediately.
Everything that can be stored
“Strictly necessary” items are needed for the site to work and to honour your choices; they are not used for measurement. Everything marked Analytics is optional and off until you say otherwise. Media on this site — including the home-page background video — is served from Pckup’s own origin, so displaying it involves no third-party host and needs no consent category.
| What | Category | Exactly what is stored | Why | Kept for |
|---|---|---|---|---|
| Your privacy choice | Strictly necessary | A first-party cookie named pk_consent holding the policy version (currently v3), the time you chose, and one on/off value per optional category. Nothing else. | So the site knows what you allowed, can stop when you withdraw, and can re-ask when the disclosure changes. | 182 days, or immediately when you change it, or sooner if the disclosure materially changes |
| Consent receipt | Strictly necessary | The policy version, the categories you allowed or refused, the timestamp, whether your browser sent Global Privacy Control, and a random receipt id your browser generates. No IP address, no device details, no account link. | Accountability: the record that a choice of this shape was made at this time. Refusals are recorded too — that record is the proof optional processing stayed off. | 400 days |
| Theme preference | Strictly necessary | Your light/dark appearance choice, in this browser only. | To render the site the way you asked for it. | Until you clear your browser storage |
| Random browser and session ids | Analytics | Two random values this browser generates for itself — one per browser, one per visit. They are not derived from you, your device, or your network, and they mean nothing outside this site. | To count sessions and returning browsers without identifying anyone. Deleted from your browser the moment you withdraw consent. | 30 days on the server; removed from your browser immediately on withdrawal |
| Pages viewed and the order you viewed them in | Analytics | The path only, with any query string and fragment stripped and long numeric or id-shaped segments replaced — for example /track/_ rather than /track/12345. Never the full URL. | To see which pages are used and how visitors move between them. | 30 days for the session record, 30 days for the daily counts |
| Entry page, exit page, and referring site | Analytics | The first and last page of the visit, and the host name of the site you arrived from (for example news.ycombinator.com) — never the full referring URL. | To understand how people reach Pckup and where they leave. | 30 days / 30 days |
| Timestamps and engaged time | Analytics | Event times, and seconds during which the page was both visible and focused (event types: page-view, heartbeat). | To distinguish a page someone read from a tab left open in the background. | 30 days / 30 days |
| Coarse device category | Analytics | One of "desktop", "mobile", "tablet", or "bot". The full user-agent string is never stored. | To know whether the site is being used on a phone or a computer. | 30 days |
| Country | Analytics | A two-letter country code supplied by the hosting network (for example US). No region, no city, no coordinates. | To know which countries Pckup is used from. | 30 days |
| A rotating network signal (never your IP address) | Analytics | Your IP address is used for a fraction of a second in memory to compute a keyed one-way HMAC-SHA256 value that mixes in the current ISO week and a secret key held only on the server, and is then discarded. The resulting value is stored; your IP address is not. Because the week and the key change, the value cannot be linked across weeks or back to an address, and it never appears anywhere in the administrator interface. | To rate-limit abuse of the collection endpoint and to count roughly how many visits come from a network already seen this week. It is a NETWORK signal, not proof that the same person returned — offices, homes, schools, VPNs and mobile carriers share networks. | 14 days |
What Pckup never collects
These are not omissions from the table above — they are prohibitions the implementation enforces, and there are automated tests that fail the build if any of them appears in a stored record:
- Your IP address, in any stored form, and no plain or unsalted hash of it.
- Precise location or coordinates. The site also sends a browser policy header that switches the geolocation API off entirely.
- Query strings and URL fragments — stripped before anything is written.
- Names, email addresses, phone numbers, postal addresses, payment details, or anything you type into a form.
- Keystrokes, mouse movement, scroll recordings, or session replay of any kind.
- Device fingerprints: no canvas, font, audio, or hardware probing; not even the full user-agent string.
- Cross-site or cross-device identifiers. Nothing stored here means anything on any other website.
- Advertising or marketing profiles. There is no advertising vendor, and no data is ever sold or shared for anyone else’s purposes.
How the choice works
- Nothing optional runs before you choose. No analytics request and no third-party media request is made while the banner is still waiting for an answer.
- Accept all, Reject all, and Customize choices are equally easy — same layer, same size, same styling. Refusing is one click, exactly like accepting.
- Nothing is pre-ticked, and closing the banner, scrolling, or continuing to browse is not consent. Only pressing one of the buttons is.
- Withdrawal is one click, at any time, from “Privacy and cookie settings” in the footer of every page. Collection stops immediately and the random identifiers are deleted from your browser.
- Global Privacy Control is honoured. If your browser sends the GPC signal, analytics starts off, the banner says so, and the server refuses events unless you personally switched analytics on in the settings dialog afterwards.
- “Accept all” never grants location access. It covers the one disclosed optional category — analytics — and nothing else. If any future feature ever needs your location, your browser will ask you separately, at the moment of use.
- Refusing costs you nothing. Every page, including the home-page background video, works and looks identical whether you accept or refuse.
Your choice is recorded against policy version v3 and we ask again after 182 days, or sooner if what we disclose materially changes — a new disclosure means the old answer no longer covers the question.
Conversion counting
Nothing is being counted. A server-to-server interface exists for counting completed business outcomes in aggregate (quote-requested, account-registered, order-placed, order-completed), but it is switched off, no system is connected to it, and it has never received an event. If it is ever connected, it will carry only a type, a timestamp, and a count — never a customer identity, never form contents.
How to reach us, and how to exercise your rights
You can change or withdraw your privacy choices yourself at any time, with no request and no waiting: use Privacy and cookie settings at the bottom of every page. Withdrawing stops collection immediately and deletes the random identifiers from your browser.
For anything else — a question, a complaint, or a request to access or delete data — these are the channels this site currently offers:
- The business enquiry form on the delivery API page, which reaches the Pckup team.
- If you have a Pckup account, the support form in your dashboard.
A dedicated privacy mailbox is not published yet. Because the analytics described here is deliberately built so that no record can be traced to a person, there is in practice nothing person-specific for us to look up, export, or delete on request — the identifiers are random, the network value is one-way and rotating, and your IP address is never stored. The one record you control directly is your own consent choice, and the settings link above deletes it.
The broader picture — legal bases, processors, and your rights — is in the privacy policy. The engineering decision record behind all of this lives in the repository as docs/PRIVACY_BOUNDARY.md.