Tracking controls
Cookie and Tracking Policy
Draft inventory and rules for cookies, session storage, analytics, affiliate redirects, pixels, and newsletter tracking.
Effective date: 2026-08-29
Review status: Owner execution version. Contact CREN for notices; not attorney approval.
Current known tracking
- Member and admin login use first-party HTTP-only session cookies.
- Pageview and activation endpoints record path-level engagement using daily visitor hashes, not raw IP addresses or full user agents in the analytics tables.
- Affiliate redirects can log partner slug, source path, and referrer for reporting.
- Newsletter providers, pixels, third-party analytics, and advertising tags must be inventoried before activation.
Cookie categories
- Essential: login, security, form protection, and site operation.
- Analytics: aggregate audience, content, and conversion measurement.
- Advertising: sponsor measurement, campaign attribution, pixels, and retargeting if added.
- Personalization: saved areas, preferences, and newsletter topic selection where supported.
Controls
CREN should provide opt-out or consent controls when legally required or when non-essential advertising, retargeting, or cross-site tracking is activated. Dark patterns, pre-checked telemarketing consents, and hidden tracking disclosures should not be used.