1. What are cookies?

Cookies and similar technologies, such as localStorage and sessionStorage keys and tracking pixels, are small pieces of data stored on or read from your device when you visit a website. They help the site work and show how it is used.

This policy covers trapspotter.com and, where it says so, the web app at app.trapspotter.com. The iOS and Android apps use no browser cookies: they use localStorage — a similar technology by the definition above — for your preferences and your consent choice, and the measurement tools described in section 11 of our privacy policy, which you control under Settings → Analytics & Tracking.

2. Which cookies and trackers do we use?

Strictly necessary

trapspotter_cookie_consent stores your choice in the cookie banner for 12 months, on trapspotter.com and its subdomains. It needs no consent. Our host, Vercel, may also set a short-lived security cookie when it checks that a visit comes from a browser rather than a bot.

Analytics and advertising measurement — only if you accept

Google Analytics 4 (Google Ireland Limited; our own property) runs on every page in Google Consent Mode. Until you choose, and if you reject, it sends only cookieless pings: no cookies and no lasting identifier.

If you accept, it sets _ga and _ga_GE50TQTHLK (13 months) and, because our Google Analytics property is linked to our own Google Ads account, Google’s ad-measurement cookies such as _gcl_au (also 13 months), so that we can see which of our own ads bring visitors. It records the pages you view, taps on the store buttons and completed forms — never what you typed. Email addresses and sign-in and unsubscribe tokens in page addresses are removed before they reach Google.

Microsoft Clarity (Microsoft Ireland Operations Limited; our own project) shows us how the site is used — heatmaps of where people click and scroll, and session recordings — so that we can improve it. It is loaded only after you accept: before that, and if you reject, its script is not on the page at all. It records page addresses, clicks, scrolling, mouse movement and how the page looked. Everything you type into a field is masked in your browser, as are numbers and email addresses, and the Mijn Boete form, the contact form and the newsletter form are masked completely, so their content is never sent. Clarity does not load on the pages you open from a link in an email (unsubscribe and confirmations). It sets _clck (1 year) and _clsk (1 day) on trapspotter.com and the sessionStorage key _cltk (deleted when you close the tab). Microsoft may also set its own cookies on its own domains (clarity.ms, bing.com), such as MUID, CLID, ANONCHK, MR and SM. We do not use Clarity for advertising and tell Clarity so, and we do not sell this data.

Cookieless statistics

Vercel Web Analytics (Vercel Inc.) counts page views in aggregate and stores nothing on your device. Our own statistics go to our servers at Supabase in the EU; they use a hash that changes every day and three sessionStorage keys that are deleted when you close the tab: ts_sid (the visit), and ts_utm and ts_campaign (the campaign of this visit, used to tag the store links). Neither sets a cookie.

Store links

When you tap an App Store or Google Play button, the link passes the campaign of your visit (utm_* parameters and, if present, the ad click id) to Apple or Google, so that installs can be attributed to campaigns. The Smart App Banner that Safari on iPhone may show for our app is displayed by Safari itself.

Not on this website

No Meta Pixel, no Google Tag Manager and no advertising pixel.

The web app (app.trapspotter.com)

The web app reports to the same Google Analytics web stream, with every consent signal denied by default. Your choice in this website’s banner also applies there until you choose in the web app, and in the web app ‘Allow’ counts as accepting on this website, ‘Analytics only’ or ‘Don’t allow’ as rejecting (one cookie, trapspotter_cookie_consent). In the web app you refine it with its own consent prompt and Settings → Analytics & Tracking: product analytics allows the Google Analytics cookies, advertising measurement allows Google’s ad measurement. With product-analytics consent it measures page views and product events (account created, onboarding finished, navigation started and finished, report submitted, paywall shown) and, reported by our server when a web subscription starts or renews, the subscription as a conversion with its value and currency, linked to the Google Analytics browser identifier. Without that consent it sends only cookieless pings. The web app runs no Meta Pixel, no Tag Manager and no Clarity.

3. Consent and controls

Non-essential cookies are set only after you consent. You can change your choice at any time.

Website: the cookie banner. Accept allows the Google Analytics cookies, Google’s ad-measurement cookies and Microsoft Clarity; Reject keeps Google Analytics on cookieless pings and Clarity off. You can change or withdraw your choice at any time with the Cookie settings button at the top of this cookie policy: it reopens the banner, and rejecting there after an earlier Accept also stops Clarity and deletes those cookies from your browser (except Microsoft’s cookies on its own domains, which only your browser settings can remove). You can also delete the cookies for trapspotter.com in your browser, and the banner will ask again
App — iOS, Android and the web app: the app’s own consent prompt, and afterwards Settings → Analytics & Tracking. There are two separate switches — product analytics and advertising measurement. Turning product analytics off stops Google Analytics measuring you with an identifier: the web app falls back to cookieless pings, and the iOS and Android apps also erase the identifier on your device. Turning advertising measurement off immediately revokes consent for Meta and for advertising use by Google in the app. The website banner and the app’s switches are separate choices
In-app advertising (Google AdMob): use Settings → Ad privacy options. This reopens Google's own consent dialog, where you can change or withdraw your choice at any time. It is separate from the switches above

Browser settings

You can also manage cookies through your browser. Blocking strictly necessary cookies may affect website functionality.

4. Third-party trackers

Google Analytics 4 — Google Ireland Limited, our own property, linked to our own Google Ads account: on trapspotter.com behind the cookie banner, and in the web app at app.trapspotter.com behind the app’s own consent. Google may process data in the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses. Policy: https://policies.google.com/privacy
Microsoft Clarity — Microsoft Ireland Operations Limited, our own project: heatmaps and masked session recordings on trapspotter.com only, loaded only after you accept in the cookie banner. Microsoft is an independent controller of this data and may process it in the United States under the EU–US Data Privacy Framework and Standard Contractual Clauses. Cookies on Microsoft’s own domains cannot be deleted from our website; your browser settings can. Policy: https://www.microsoft.com/privacy/privacystatement
Vercel Web Analytics — Vercel Inc.: cookieless, aggregate page-view counts on trapspotter.com; nothing is stored on your device. Policy: https://vercel.com/legal/privacy-policy
Meta Platforms Ireland (Facebook / Instagram) — only in the iOS and Android apps, with your consent to advertising measurement: the Meta SDK and the Meta Pixel inside the app. Not on the website and not in the web app. Meta acts as an independent controller for this and processes it in the United States under Standard Contractual Clauses. Policy: https://www.facebook.com/privacy/policy/
Google Analytics for Firebase — in the iOS and Android apps only: measurement of our own Google Ads campaigns, only after you enable product analytics (advertising use also needs advertising measurement). This is not a website cookie; you control it under Settings → Analytics & Tracking. Policy: https://policies.google.com/privacy
Google AdMob — advertising in the mobile app, shown only to users without a Premium subscription. These are not website cookies: AdMob uses your device's advertising identifier and is controlled through the consent dialog the app itself presents, not through the cookie banner. Policy: https://policies.google.com/privacy
Google Play Install Referrer — in the Android app only: the campaign an install came from, read on first launch; the ad click id in it is kept only with your consent to advertising measurement. Policy: https://policies.google.com/privacy
Apple Ads attribution (AdServices) — in the iOS app only, with your consent to advertising measurement: whether the install came from an Apple Ads campaign (campaign, ad group and keyword ids, no device identifier). Policy: https://www.apple.com/legal/privacy/

5. Retention

trapspotter_cookie_consent: 12 months
Google Analytics cookies _ga and _ga_GE50TQTHLK: 13 months; Google’s ad-measurement cookies such as _gcl_au: 13 months
Microsoft Clarity cookies: _clck 1 year, _clsk 1 day; sessionStorage key _cltk: deleted when you close the tab. Microsoft’s own cookies on its domains, as Microsoft sets them today: MUID about 1 year, CLID 1 year, MR 7 days, ANONCHK 10 minutes, SM for the session
sessionStorage keys ts_sid, ts_utm and ts_campaign: deleted when you close the tab
Google Analytics data — from the website, the web app, and Google Analytics for Firebase in the iOS and Android apps: 14 months, the retention we set in our property
Microsoft Clarity data: recordings 30 days (a random sample, and recordings we mark, up to 9 months); heatmap and click data 9 months — Microsoft’s retention
Meta events from the iOS and Android apps: retained according to Meta’s policy

6. Contact

Privacy / GDPR: privacy@trapspotter.com

General: contact@trapspotter.com

Address: TrapSpotter BV · Trekschurenstraat 245, 3500 Hasselt, Belgium