Cookie Policy

Effective August 27, 2026 · Version 1.1

This policy describes the cookies and similar technologies used at handcarry.app (the "Platform"), operated by HandCarry Technologies LLC. It is part of the Terms of Service and is summarized in the Privacy Policy.

The short version: the Platform sets four cookies of its own, all functional — including the one that remembers your cookie choice. Analytics (Google Analytics) runs only under the consent model in Section 2, is never tied to your identity, and can always be turned off. Two other third-party services run in your browser for specific functional purposes. There are no advertising, retargeting, or cross-site tracking technologies.

1. Cookies we set

All four cookies HandCarry sets are first-party (set by handcarry.app), functional, and contain no advertising or tracking identifiers. The first three are strictly necessary — the Platform works only with them enabled. hc_consent exists so we can honour your choice without asking again on every visit; it is set when you make or acknowledge a choice. The two __stripe_* cookies are set by Stripe, only on payment pages — see Section 3.

2. Analytics, and your choice

The Platform uses Google Analytics, loaded through Google Tag Manager, to understand how the site is used: which pages are visited, and where visitors come from. What happens by default depends on where you are:

• In the European Economic Area and the United Kingdom, whose law requires asking first, analytics stays off until you actively agree. A banner offers Accept, Reject, and Manage settings with equal prominence, and nothing analytics-related loads before you choose.
• Everywhere else, analytics is on from your first page view. A notice tells you so on your first visit, and a "Turn off" action — exactly as visible as the acknowledgement — switches it off for your browser from then on.
• In every region, if your browser sends the Global Privacy Control signal, we treat it as "off" automatically. You can still switch analytics on yourself in the cookie settings if you want to.

To decide which of these applies, we read the visitor country that Cloudflare, our network provider, attaches to each request; it is used for that decision in the moment and is not stored. Your choice itself is stored in the hc_consent cookie and can be changed at any time through the Cookie settings control in the page footer, or with the button at the top of this page.

When analytics is allowed to run, Google sets its measurement cookies on our domain:

What Google receives is deliberately limited. Page addresses are cleaned before they are sent: only the page path and recognised campaign tags (such as utm_ parameters) are included, and everything else in the address is removed. No account identity is ever sent — signed in or not, Google sees an anonymous browser. Google's advertising features (Google Signals, demographics, ad personalisation) are switched off, analytics data is retained by Google for 14 months, and Google processes this data for us under Google's data-processing terms — see the Privacy Policy, Sections 5.2 and 10. Turning analytics off also deletes Google's cookies from your browser.

3. Other third-party services in your browser

Two further third-party services run in your browser, each for a specific functional purpose:

• Cloudflare Turnstile — a bot-protection check shown on our public forms: sign-up, sign-in, password-reset, phone verification, and the pre-launch interest form. It loads from Cloudflare and may use its own technical mechanisms to distinguish humans from bots; in verifying you, your IP address is processed by Cloudflare. Turnstile is a security control, not a tracker.
• Stripe.js — loads only on payment pages to embed Stripe's secure card form, which is how your card number goes directly to Stripe and never touches HandCarry's servers. Stripe.js sets Stripe's fraud-prevention cookies on our domain: __stripe_mid (about 1 year) and __stripe_sid (about 30 minutes), used by Stripe to detect payment fraud, under Stripe's own privacy policy.

Beyond the services this policy names, no other third-party scripts, pixels, embeds, or fonts load on the Platform. Web fonts are self-hosted specifically so your visits are not disclosed to a fonts CDN.

4. What we do not use

• No advertising or retargeting cookies
• No social media pixels or embeds
• No cross-site tracking of any kind
• No browser fingerprinting
• No advertising features inside analytics (Google Signals and ad personalisation are off)

We honour the Global Privacy Control browser signal as described in Section 2. The older "Do Not Track" signal has no separate effect beyond that.

The Platform also uses on-device browser storage for small functional preferences — for example, remembering that you dismissed an informational banner, and a display-theme preference. These stay on your device and are sent nowhere.

5. Managing cookies

Your analytics choice is changeable at any time through Cookie settings in the page footer or with the button at the top of this page. Beyond that, you can delete or block cookies in your browser settings. Blocking the Platform's essential cookies will prevent signing in, and blocking Stripe's cookies may prevent paying. Choosing not to tick "remember me" avoids the persistent sign-in cookie entirely.

6. Changes

Version 1.1 is the change this policy previously promised: analytics was introduced, and this policy and the Privacy Policy were updated first, in the same release, with consent asked for where the law requires it. If we introduce further non-essential cookies (for example, an advertising pixel), the same sequence applies: policy first, consent where required, announcement as described in the Terms of Service. Each version of this policy is numbered and dated.

Questions: [email protected].