Cookie and Local Storage Policy

Cookies, local storage, session storage and IndexedDB are four ways a site can leave something behind in your browser. This page lists everything MADBOT leaves behind, in each of those forms, and why.

It also explains the part most cookie pages skip: what happens when you refuse. In MADBOT the answer is enforced in code. Every piece of non-essential storage passes through a single gate that checks your recorded choice first, and that gate returns false when no choice has been recorded. A script added without a consent check therefore fails closed rather than running quietly.

For what we do with personal data more generally, see the Privacy Policy.

The strictly necessary entries are the two things the site cannot work without: what keeps you signed in, and the record of your answer to the banner. Refusing the record of your answer would mean being asked the question on every page, which is why no consent is required for it.

MADBOT runs no advertising and no analytics. No ad network, no ad cookies, no Google Analytics, no pixel, no fingerprinting, no session recorder and no A/B testing tool. Nobody here is measuring your behaviour on this site or profiling you to sell an impression against it.

This site did carry Google AdSense for a short period. It has been removed: MADBOT sells a product rather than publishing content, and an ad network is the wrong thing to have on a page where somebody is reading a price. Nothing of Google's is loaded, set or read here any more, and we do not share personal information for cross-context behavioural advertising under the California CPRA or any equivalent state law.

The categories named Analytics and Advertising still appear in the table above with nothing in them. That is deliberate. An empty category on the record is a verifiable claim: you can see that we considered the question and that the answer is currently none. Deleting them would make the claim disappear rather than making it stronger, and they are the switches anything added later would have to pass through before it ran.

If that ever changes, the vendor will be added to the inventory in the same commit that adds the script, this page will show it the moment it is deployed, and consent will be asked for again before it runs. It cannot happen the other way round, because the gate described above refuses anything the inventory has not been updated for.

The consent notice you see depends on where you appear to be. We work this out from a country code our hosting providers add at the edge, and we do not store your IP address to do it.

Showing everybody the strictest possible wall is not compliance, it is a worse product for no legal gain. Showing everybody the most permissive option is a regulator's problem. So the notice follows your law:

• Opt in. Nothing optional runs until you agree. Refusing is as easy as agreeing, both are one click, and staying silent counts as refusal. This is what the ePrivacy Directive and the GDPR require in the EEA, and what the UK, India, Brazil, Canada, South Korea, the Gulf states and several others require too.
• Opt out. Optional storage may start, you are told about it, and you get a standing and easy way to stop it, including an automated browser signal. This is the United States model, and it applies in Japan, Singapore, Australia and elsewhere.

Advertising storage is never on by default in any country. If we cannot tell where you are, you get the opt-in notice, because the cost of asking somebody who did not need to be asked is one click.

Whichever notice you get, the choice you make is recorded with the date, the country, and how you gave it, so that a consent we never actually received cannot be claimed later.

If your browser or an extension sends a Global Privacy Control signal, we honour it. It is treated as a valid opt-out before any banner is shown, and it overrides an opt-out default, so nothing in the analytics or advertising categories may run regardless of what any stored answer says.

The one thing GPC does not switch off is the preferences category, because remembering your theme and your currency is for you, not for us, and losing it every visit would be a worse experience with no privacy gain.

GPC is a legally recognised opt-out in California, Colorado and Connecticut among others. We honour it everywhere, not only where we are required to.

Your answer is not final and you do not have to clear anything to change it. At the bottom of every page on this site, under Legal, there is a Cookie preferences control. Click it and the preference panel opens with your current choices, wherever you are on the site.

If you are curious about the mechanism: that control dispatches a madbot:open-consent event on the window, which the consent panel listens for. It is the same panel you saw the first time, showing the same categories.

Turning a category off takes effect immediately for anything that has not already run, and anything already written under that category is removed. There is no dark pattern here: rejecting everything optional is a single click and does not cost you access to any part of the service.

You can also delete everything yourself, without our involvement. Local storage and cookies for a site are cleared from the browser's own settings.

• Chrome and Edge: Settings, then Privacy and security, then Third-party cookies or Cookies and site data, then See all site data and permissions. Search for getmadbot.com and delete it.
• Safari: Settings, then Privacy, then Manage Website Data. Search for the site and remove it.
• Firefox: Settings, then Privacy & Security, then Cookies and Site Data, then Manage Data.
• Any browser: open the developer tools, go to the Application or Storage tab, and clear Local Storage and IndexedDB for this site.

Two things follow from clearing it. You will be signed out, because the sign-in token lives in that storage. And you will be asked the consent question again, because the record of your answer is what we cleared. Both are the expected result, not a fault.

Browser-level blocking works too. If storage is blocked or you are in a private window, we treat that as "not asked yet", which means nothing optional runs. That is the safe failure, and the site still works.

One entry in the table above is not written by us. When you sign in, Firebase Authentication, which is a Google service, stores your session in local storage and IndexedDB under keys beginning firebase:authUser:. That is what keeps you signed in between visits, and it is why the entry is listed as strictly necessary rather than optional: without it, signing in would not survive a page reload.

It is only set once you have signed in. A visitor who never signs in never gets it. Signing out removes it. Google is listed as a sub-processor in the Privacy Policy and on the sub-processors page.

No other third party sets storage through this site. If you connect an integration such as GitHub or a social account, that connection is held on our servers, not in your browser.

The inventory is versioned. The record of your answer carries that version number, currently 4. When the inventory changes, the version changes, and every stored answer that refers to the old version stops counting as consent.

In practice that means you are asked again, about the new list, rather than being treated as having already agreed to something that did not exist when you clicked. Consent to an unspecified future thing is not consent, and treating it as such is the most common way a cookie banner becomes decorative.

The date at the top of this page changes whenever the inventory does.

If something here does not match what you observe in your browser, we want to know, because it would mean the inventory is wrong and the inventory is what the code reads. Write to us at support@getmadbot.com.

Related reading: the Privacy Policy for what we do with personal data, the sub-processors list for who else is involved, and the security page for how the service is protected.