1. What Are Cookies
A cookie is a small text file a website stores on your device when you visit. Cookies let a site remember your actions and preferences between page loads and between visits, so you do not have to re-enter the same information every time.
This policy also covers technologies that work in comparable ways:
- Local storage and session storage - browser storage that persists between visits (local) or for the life of a tab (session).
- Pixels and web beacons - small transparent images embedded in a page or an email that record whether it was opened or viewed.
- Fingerprinting signals - characteristics of your device and browser, such as screen size or installed fonts, that can be combined to infer identity. We do not fingerprint visitors.
2. Categories We Use
We sort cookies into four categories by purpose. Only the first is exempt from consent, because the Site cannot be served securely without it.
| Category | Purpose | Consent required | In use today |
|---|---|---|---|
| Strictly necessary | Serving the Site, security, bot and DDoS mitigation, and remembering your cookie choice | No | Yes |
| Functional | Remembering preferences such as language or region | Yes | No |
| Analytics and performance | Measurement of how the Site is used - pages viewed, time on page, clicks, scroll depth, errors | Yes | Yes, only after you opt in |
| Marketing and targeting | Advertising on other platforms and measuring ad performance | Yes | No |
3. Cookie Inventory
Every cookie the Site may set is listed here. Durations are maximums; most are cleared sooner, on session end or when you withdraw consent.
3.1 Strictly necessary
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
wardorx_cookie_consent | First-party (wardorx.com) | Stores your consent choice per category, and the policy version it was given against, so we can re-ask when this policy materially changes | Persistent | 365 days |
__cf_bm | Cloudflare | Bot management - distinguishes humans from automated traffic | Persistent | 30 minutes |
cf_clearance | Cloudflare | Records that a security challenge was passed, so you are not repeatedly challenged | Persistent | Up to 1 year |
__cflb | Cloudflare | Load balancing - keeps a session pinned to one origin server. Set only where load balancing is active | Persistent | Up to 1 day |
The Cloudflare cookies above are set by our infrastructure provider as part of serving and protecting the Site. They carry no advertising identifier and are not used to profile you. See Cloudflare's cookie documentation.
3.2 Analytics and performance
We use three analytics tools. Google Analytics 4 counts visits: which pages get viewed, where visitors came from, and whether they called, booked or sent a form. Microsoft Clarity shows where people stop scrolling and where the page breaks: it records page interactions - clicks, scrolls, mouse movement and navigation - and replays them as an anonymised session. SearchAtlas reads the pages you view to check and improve how they are optimized for search. None of the cookies below are set until you opt in to the Analytics category. Before that none of these tools' code is on the page at all - it is fetched only at the moment you say yes, not shipped disabled and switched on.
Google Analytics is loaded through Google Tag Manager, Google's tag loader, which itself sets no cookies and is fetched only after you opt in, at the same moment as Google Analytics. Google Analytics runs in Google's Consent Mode with every advertising signal switched off: Google signals, ad personalisation and ad storage are never enabled, because we run no ads. We never send it your name, email address, phone number or anything you type into a form - only that a form was sent, and which one.
| Name | Provider | Purpose | Type | Duration |
|---|---|---|---|---|
_ga | Google Analytics | A random ID that lets Google Analytics tell one returning browser from a new one, so visits are counted once | Persistent | 2 years |
_ga_S961FXVT3M | Google Analytics | Keeps the state of the current visit (session) for our Google Analytics property | Persistent | 2 years |
_clck | Microsoft Clarity | Persists a Clarity user ID so repeat visits are attributed to one session history | Persistent | 1 year |
_clsk | Microsoft Clarity | Joins the page views of a single visit into one recording | Persistent | 1 day |
CLID | Microsoft (clarity.ms) | Identifies the browser to Clarity's own domain on first visit | Persistent | 1 year |
MUID | Microsoft (c.bing.com) | A Microsoft-wide browser identifier, also used by Bing and Microsoft Advertising | Persistent | 390 days |
ANONCHK | Microsoft (c.clarity.ms) | Records whether the MUID is transferred for analytics on the Microsoft ad network | Persistent | 10 minutes |
SM | Microsoft (c.clarity.ms) | Synchronises the MUID across Microsoft domains | Session | Session |
MUID, ANONCHK and SM are set on Microsoft-owned domains and are shared with Microsoft Advertising, so opting in to analytics here does hand a browser identifier to a network that also serves ads. That is the trade Clarity makes and we would rather write it down than bury it. Rejecting analytics prevents all eight cookies in this table.3.3 Functional and marketing
None currently set. We run no preference cookies, no chat widget and no advertising or retargeting pixel of our own. If we add any, they will load only after you opt in to the matching category, and this table will be filled in before they go live.
4. What We Deliberately Do Not Use
Stating this plainly because it is unusual enough to be worth writing down:
- No Google Ads, and nothing extra in Google Tag Manager. Our Tag Manager container loads Google Analytics and nothing else, only after you opt in, with advertising features off. If we ever add another tool to it, it will be listed here first and the banner will ask you again.
- No keystroke capture. Clarity records interaction, not what you type. Form fields are masked in the recording.
- No advertising or retargeting pixels of our own - no Meta pixel, no LinkedIn Insight Tag, no Google Ads remarketing tag.
- No third-party embeds that phone home on load. The booking panel talks to Cal.com from our server, not from your browser, so Cal.com sets nothing on your device unless you click through to their site.
- No data broker or enrichment scripts, and no selling or renting of any information collected here.
5. Third Parties
A third-party cookie is one set by a domain other than wardorx.com. Three third parties set cookies here: Cloudflare, our CDN and security provider (section 3.1, no consent needed), and Google Analytics and Microsoft Clarity (section 3.2, only after you opt in). Google's handling of what Google Analytics collects is described in How Google uses information from sites that use its services; Microsoft's handling of what Clarity collects is governed by the Microsoft Privacy Statement.
Two other providers process data for us but do not set cookies in your browser, because we call them from our server rather than embedding their code in the page:
| Provider | What it does | Sets cookies here |
|---|---|---|
| Cal.com | Supplies our availability and records bookings you make in the booking panel | No - server-side API only |
| Resend | Delivers the audit report email when you ask for one | No - server-side API only |
How each of these handles personal information is covered in our Privacy Policy. Their own policies: cloudflare.com/privacypolicy, cal.com/privacy, resend.com/legal/privacy-policy.
6. Your Consent & How to Change It
On your first visit a consent banner appears. You can:
- Accept all - allows strictly necessary, functional, analytics and marketing categories.
- Essential only - allows strictly necessary cookies and nothing else. No analytics loads.
- Manage preferences - switch each category on or off individually.
Your choice is stored in a first-party cookie, wardorx_cookie_consent, for 365 days, after which we ask again. We also record which version of this policy you consented to; if we materially change what we set, the banner returns and asks fresh rather than assuming your old answer still applies.
To change your mind at any time, click Cookie Preferences in the footer of any page. Withdrawing consent is exactly as easy as giving it, and takes effect immediately.
7. Managing Cookies in Your Browser
You can also control or delete cookies directly in your browser, independently of anything on this Site:
- Chrome: support.google.com/chrome/answer/95647
- Safari: support.apple.com/guide/safari
- Firefox: support.mozilla.org/kb/cookies
- Edge: support.microsoft.com/edge/cookies
Most browsers also offer a Do Not Track or Global Privacy Control signal. We honour Global Privacy Control as a withdrawal of consent for the analytics and marketing categories.
8. Effect of Disabling Cookies
- Browsing, the audit tool, the booking panel and every form continue to work normally.
- Google Analytics, Microsoft Clarity and SearchAtlas do not load, so no visit is counted, no session is recorded and none of the cookies in section 3.2 are set. If you withdraw consent later, we tell Google Analytics to stop and delete its
_gacookies straight away. - Blocking the Cloudflare cookies in section 3.1 may cause repeated security challenges, since there is nothing recording that you already passed one.
- Blocking the consent cookie itself means the banner reappears on every visit, because the record of your answer is what that cookie holds.
9. Changes to This Policy
We update this page whenever we add, remove or change a cookie. Material changes are reflected in the Last Updated date and the version number above, and where new consent is required the banner re-prompts rather than carrying your previous answer forward.
10. Contact
Questions about cookies, or a request to see what we hold? Contact our Privacy Officer:
WARDORX Attn: James Frost, Privacy Officer Calgary, Alberta, Canada Email: privacy@wardorx.com