Cookie Policy
Last updated: July 16, 2026
This policy describes cookies, tags, pixels, and browser storage used by Full Stack Marketing and Aion. On eligible U.S. public pages, limited Analytics and Marketing measurement is enabled by default with a clear notice and immediate opt-out. Outside the United States, or when country-level location is unavailable, optional technology stays off until the visitor opts in.
Categories
Necessary
Required for security, authentication, billing, privacy choices, support, and requested product functions. These cannot be disabled through the cookie manager.
Analytics
Google Analytics measurement on eligible public marketing pages. U.S. visitors may opt out; visitors elsewhere opt in. Advertising storage, Google Signals, and ad personalization remain off.
Marketing and CRM measurement
HubSpot public-site traffic and campaign measurement on eligible pages. U.S. visitors may opt out; visitors elsewhere opt in. It does not load inside authenticated Aion workspaces or on public form-entry routes.
Cookie and storage inventory
Names and durations may be shortened by browser privacy controls or changed by a vendor. We review this table when the implementation changes.
| Category | Name | Provider | Type | Purpose | Typical duration |
|---|---|---|---|---|---|
| Necessary | fsm_privacy_consent_v1 | Full Stack Marketing | Local storage | Remembers the policy version and your Analytics and Marketing choices. | Until the policy version changes or browser storage is cleared |
| Necessary | fsm_accessibility_preferences_v1 | Full Stack Marketing | Local storage | Remembers optional text, contrast, motion, link, and keyboard-focus display preferences on this device. | Until the preference version changes, you reset it, or browser storage is cleared |
| Necessary | __hs_do_not_track | HubSpot | First-party cookie | Records an explicit HubSpot opt-out and prevents the HubSpot tracking code from sending information. | Up to 6 months |
| Necessary | Project-scoped authentication storage | Supabase / Aion | Local storage or secure session storage | Keeps an authenticated Aion session active and refreshes it securely. The exact key is project-scoped. | Until sign-out, expiration, or storage is cleared |
| Analytics | _ga | Google Analytics | First-party cookie | Distinguishes eligible public-site visitors while Analytics is enabled. | Up to 2 years |
| Analytics | _ga_<measurement-id> | Google Analytics | First-party cookie | Persists eligible public-site session state while Analytics is enabled. | Up to 2 years |
| Marketing | hubspotutk | HubSpot | First-party cookie | Represents an eligible public-site visitor for traffic attribution and form deduplication while Marketing measurement is enabled. | Up to 6 months |
| Marketing | __hstc | HubSpot | First-party cookie | Stores eligible public-site traffic and session attribution while Marketing measurement is enabled. | Up to 6 months |
| Marketing | __hssc | HubSpot | First-party cookie | Tracks an eligible public-site session while Marketing measurement is enabled. | 30 minutes |
| Marketing | __hssrc | HubSpot | Session cookie | Helps HubSpot determine whether an eligible visitor restarted the browser. | Browser session |
| Marketing | __cf_bm, __cfruid, __cfuvid | HubSpot delivery network | Cookie | May support rate limiting, bot protection, and delivery after HubSpot measurement is enabled. | About 30 minutes or the browser session, depending on the cookie |
How consent works
- We use a country-level hosting signal only to select a U.S. opt-out mode or a strict opt-in mode. We do not return or store an IP address, city, or precise location in the consent record.
- On eligible U.S. public pages, Analytics and Marketing measurement may load while the notice is visible. Opt out stops both immediately.
- Outside the United States, or if the country signal is unavailable, optional scripts and requests remain blocked until the visitor enables a category.
- Analytics, when enabled, loads Google Analytics only on eligible public pages.
- Marketing, when enabled, loads HubSpot only on eligible public pages, excluding signup, request-access, contact, booking, and hiring form routes.
- Rejecting or revoking optional consent stops future tracking and removes known optional first-party cookies where the browser permits it.
- Changing pages into an authenticated or sensitive route pauses public marketing tags even if optional consent was granted earlier.
- We do not currently load advertising pixels or grant advertising storage.
Global Privacy Control
If your browser sends Global Privacy Control, it overrides every regional default. Optional Analytics and Marketing choices are forced off and locked while the signal is active. The choice is applied to that browser or device. You can review the result in Your Privacy Choices.
Authenticated Aion and hosted checkout
Google Analytics and HubSpot marketing tags are not installed on authenticated dashboard, account, proposal, client-room, or privacy-request status routes. Aion uses necessary first-party session, security, billing, credit, generation, delivery, audit, and support records to provide the service. When you open Stripe-hosted Checkout or Customer Portal, Stripe may use cookies under its own privacy and cookie terms.
Manage or delete cookies
Use the Cookie Settings button, Your Privacy Choices in either footer, or the cookie icon on a public page. Browser controls can also delete stored values. Deleting the consent record causes the banner to appear again. Blocking necessary storage may prevent sign-in or requested product functions.
For privacy rights or data deletion, review our Privacy Policy or submit a Privacy Request.
Contact
Questions about this inventory or your choices can be sent to data-privacy@fullstackmarketing.digital.