XECbuild
Request Assessment
Request Assessment
Legal

Cookie policy

The short version: the public marketing site sets no cookies of its own. What follows is the complete list of everything that can end up in your browser, and how to stop each one.

Last updated 17 August 2026

What we set

Nothing, on the public site. There is no consent banner because there is nothing to consent to for the pages you are reading. The one cookie we set anywhere is on our admin console, which you cannot reach.

__session
Strictly necessary. Admin console only. Holds a signed sign-in session so an administrator does not re-authenticate on every page. HttpOnly, Secure, SameSite=Lax. Expires after 8 hours. Never set on the public site.

What third parties may set

Cloudflare Turnstile
Strictly necessary. On the contact page only. Runs a bot challenge and may store a short-lived token in your browser to avoid re-challenging you. It is a privacy-preserving alternative to a CAPTCHA and is not used to track you across sites. Without it the form cannot be submitted.
Cloudflare (CDN/WAF)
Strictly necessary. May set a cookie to identify individual clients behind a shared IP for security purposes. Not used for analytics or advertising.
Cloudflare Web Analytics
Analytics. Where enabled. Cookieless by design - it sets nothing and does not fingerprint you. This is why it is our preferred option.
Google Analytics (via GTM)
Analytics. Only if a container ID is configured for this deployment. Sets _ga and related cookies to count visits and measure which pages are read. Typically expires after 2 years.

How to refuse

  • Analytics. Send a Do Not Trackor Global Privacy Control signal, use your browser's tracking protection, or block googletagmanager.com. Nothing on the site depends on analytics loading, so blocking it changes nothing about how the site works.
  • Strictly necessary items. You can block these too, in your browser settings. The contact form will then stop working, because the challenge it depends on cannot run.
  • Everything. Every mainstream browser can clear and block cookies per-site from its settings.

Other storage

The site uses no localStorage, sessionStorage or IndexedDB for tracking. Firebase Authentication, used only on the admin console, writes to IndexedDB during sign-in; we delete that session immediately after exchanging it for the __session cookie, precisely so no token is left sitting in browser storage.

More

What we do with the data behind all of this is set out in the privacy policy.