What cookies are
Cookies are small text entries a website stores in your browser; localStorage keys are their slightly roomier siblings. Both let a site remember things between page loads — who you are, what you chose, where you left off. Neither can run code or read your disk. What matters is what gets remembered and who gets to read it — which is exactly what the tables below spell out.
How consent works here
- On your first visit, the consent console offers three equal choices: Accept all, Necessary only, or per-category Customize. Nothing is pre-ticked.
- Until you decide, every optional category is off and Google tags operate in cookieless consent-mode pings only.
- Your decision is stored in the first-party
gam_consentcookie for 12 months, with a timestamp as proof of consent. If our cookie usage changes materially, we bump the consent version and ask again. - Withdrawing works the same way it was given: reopen the console, flip the switch — effective immediately (Art. 7(3) GDPR).
Essential cookies — always active
These keep the service functional and secure. They are exempt from consent under § 165 Abs 3 TKG 2021 / ePrivacy because the service you request cannot work without them:
| Name | Set by | Purpose | Lifetime |
|---|---|---|---|
gam_consent | MyAdMaker | Stores your consent choices and their timestamp | 12 months |
__session, __client_uat & other __clerk_* | Clerk (our auth provider) | Keeps you signed in; protects against session forgery | Session-bound; refreshed while you use the app |
gam_ad_preview_* / gam_ad_live_* | MyAdMaker | Remembers that you unlocked a password-protected ad link — scoped to that single ad's path, holds a signed token, never an identifier | 30 days |
Analytics & marketing cookies — consent only
| Name | Set by | Purpose | Category | Lifetime |
|---|---|---|---|---|
ph_* | PostHog (EU cloud) | Product analytics and masked session replays — which features get used, where flows break | Analytics | Up to 12 months |
_ga, _ga_* | Google Analytics (via Tag Manager) | Visit measurement and campaign attribution | Analytics | Up to 24 months |
_gcl_au & other _gcl_* | Google Ads (via Tag Manager) | Conversion attribution and remarketing | Marketing | Up to 24 months |
The Google cookies listed are the standard set the tags may use once you consent; the exact names can vary as Google evolves its products. Whatever the name, nothing in this category is written before your opt-in. Session replays captured under Analytics are masked in your browser first — typed input and sensitive fields never leave your machine readable.
Local storage
| Key | Where | Purpose | Category |
|---|---|---|---|
gam:muted | Inside playable ads | Remembers your sound on/off choice in a playable | Essential |
ph_* keys | Platform pages | PostHog event queue, device context and replay buffer | Analytics — consent only |
Playable ads built with MyAdMaker set no cookies at all — the sound preference above is their entire browser-storage footprint.
Google Consent Mode v2 — the signals behind the switches
Your console choice is translated into Google's four consent signals. This is the exact mapping, current as of the June 15, 2026 update (under which ad_storage is the single authority for Google Ads data):
| Signal | Controls | Default | Unlocked by |
|---|---|---|---|
analytics_storage | Analytics cookies & measurement storage | denied | Analytics |
ad_storage | Advertising cookies — sole authority for Ads data since June 2026 | denied | Marketing |
ad_user_data | Sending user data to Google for advertising | denied | Marketing |
ad_personalization | Remarketing & personalized ads | denied | Marketing |
We additionally enable ads_data_redaction (ad identifiers are redacted while consent is denied) and url_passthrough (campaign context survives without cookies).
Your controls
- The console: — also linked in every footer.
- Your browser: you can block or delete cookies in browser settings; blocking essential cookies will break sign-in.
- Do Not Track / Global Privacy Control: our analytics honors the DNT signal — with it set, PostHog won't capture even after consent.
- Provider policies: Google · PostHog · Clerk
Changes & contact
When our cookie usage changes, this page changes first — and if the change needs new consent, the console asks again. Questions: [email protected]. The full picture of how we handle personal data lives in the Privacy Policy.
Still unsure about a cookie?
Ask us which key does what — or just flip everything off and keep using the product. It works either way.