Cookie policy and choices

Effective date: 2026-10-18

Crawle AB, Sweden, runs wristmaze.com. Its organisation number is 559595-6862; privacy enquiries: support@crawle.io. The privacy policy gives its postal address, processing details and your rights.

wristmaze.com uses necessary storage to remember your privacy choice and may use Cloudflare security cookies. The two optional purposes are Analytics (measure visits and actions) and Marketing (Google signals, advertising measurement and personalisation permissions). Both start off.

The Google Tag Manager (GTM) container and Google Analytics 4 (GA4) load only after you allow Analytics and our server acknowledges the consent record. This is basic Consent Mode: before then no measurement or advertising request, not even a cookieless or consent-status ping, goes to Google. Marketing alone is saved and recorded but loads nothing from Google in this setup. Refusing either purpose leaves the site fully usable.

Analytics and Marketing storage/access use consent under LEK Chapter 9, Section 28; the associated personal-data processing uses GDPR Art. 6(1)(a). The privacy policy describes the data, Google’s role, international processing and the separate legal basis for consent evidence. No Google Ads account is linked in this setup.

Google Search Console adds no code or cookies to the site. GTM loads the Google tags described here; it is not a separate purpose.

How you choose

Accept all allows Analytics and Marketing.
Reject all refuses both.
Choose opens independent Analytics and Marketing switches, both initially off, plus Save my choice, Reject all and Accept all.

Open Cookie settings in every page’s footer to change or withdraw either choice as easily as giving it. The necessary choice record remains available to remember a refusal. The site asks again after six calendar months or a policy-version change. This release’s consent notice is version 2026-10-launch. Cookie settings also shows Your consent record with its ID while your browser holds the acknowledged record. Save it before withdrawing all purposes or clearing storage if you want to quote it later: after Reject all, the current ID is no longer shown there.

Children and parents

This website is not directed at children under 13. If you are under 13, or cannot give valid consent under the law that applies to you, choose Reject all or leave Analytics and Marketing off. The site remains usable. There is no parental-authorisation flow for these choices.

A parent or guardian concerned about a child’s data can first copy the ID in Cookie settings if available, then turn both choices off and contact support@crawle.io. Without the ID you can still contact us and we will try to help. The privacy policy explains the children’s information and deletion process.

Storage used by the approved design

Name	Provider	Purpose	Duration	Category
`wm_consent` (localStorage)	Crawle AB / wristmaze.com	Remembers Analytics/Marketing choices, notice version/time, current consent-record ID and acknowledgement status. Also keeps unacknowledged withdrawals with their IDs, reduced choices, page versions and controls for retry, separately from a new choice. A current Analytics ID is also GA4’s browser ID.	Choice valid for 6 calendar months; the site asks again then or on a version change. Current choices can be replaced; pending withdrawals survive new choices/versions until the server records them or confirms an unknown ID. Browser settings can clear the stored value.	Necessary
`_ga`	Google Analytics, set on wristmaze.com	Distinguishes browsers after Analytics consent. Its browser/client ID is issued by our server as the consent-record ID before Google loads.	Up to 2 years by default, shorter where the browser caps it (Chrome: 400 days from setting/renewal). Renewed on consented visits under default cookie-update settings; withdrawal, browser limits or controls may end it sooner.	Analytics
`_ga_RB5L11S6D0`	Google Analytics, set on wristmaze.com	Maintains GA4 session state after Analytics consent for the site’s property.	Up to 2 years by default; Chrome caps it at 400 days from setting/renewal, with the same earlier-deletion conditions.	Analytics

These cookies have a default lifetime of up to two years, shortened by browser limits. Chrome caps expiry at 400 days from setting or renewal; a later consented visit can renew it. Chrome’s cookie-limit guidance explains that cap. Cookie expiry is not the server-held data period: GA4 user/event retention is 14 months (age, gender and interests 2 months), and consent evidence has its own period below.

Marketing storage and Google’s own cookies

With both purposes allowed, Google may use its own advertising cookies and identifiers on domains such as google.com and doubleclick.net, together with the first-party GA4 identifier, for the Advertising Features described in the privacy policy. Browser settings and Google-account eligibility also affect which cookies are available. This stage has no Conversion Linker; its storage is not listed as active.

Google Tag Manager loads from www.googletagmanager.com; GA4 can send measurement requests to region1.analytics.google.com. With both choices allowed, Google’s features can also connect to stats.g.doubleclick.net and Google country domains, such as www.google.se/ads/ga-audiences. These connections are not a separate vendor or proof that a cookie is stored on each of those domains; storage also depends on browser and Google-account settings.

Google’s country-domain request can read cookies already present from using Google while signed in. They are Google’s cookies, not new first-party cookies created by WristMaze. Their existing expiry is controlled by Google and your browser; allowing Marketing here does not mean they were newly set.

Name	Provider/domain	Purpose here	Duration	Category on WristMaze
`__Secure-3PAPISID`, `__Secure-3PSID`	Google / `google.se`	Google’s own existing sign-in cookies, read by its signed-in Advertising Features together with the visit information. WristMaze does not set or control them.	Lifetimes are set by Google and can be limited by your browser. Google’s cookie information publishes no fixed lifetime for these two names.	Marketing access
`NID`	Google / `google.se`	Google’s existing preferences cookie, also used by Google for analytics and advertising as described in its cookie information. It can accompany the signed-in Advertising Features request; WristMaze does not set it.	Google’s published lifetime is up to 6 months from the user’s last use; an existing cookie can have less time remaining.	Marketing access here; Google also uses it for its own service purposes

We cannot delete cookies on Google’s domains. Use Google’s cookie information, Google’s ad controls and My Ad Center guidance or your browser settings to manage them. These controls supplement, not replace, Cookie settings on WristMaze.

Fonts, page graphics and static pictures are served with the website, not by a third-party font or 3D service. This release offers no launch/support form, video delivery, separate media host or press-kit download.

Cloudflare security cookies

Cloudflare’s Free-plan security protection may challenge a suspicious request. The site’s Challenge Passage setting is 30 minutes.

Name	Provider	Purpose	Duration	Category
`cf_clearance`	Cloudflare	Records that a visitor passed a security challenge, to avoid repeating it immediately.	Challenge Passage is set to 30 minutes.	Necessary/security
`cf_chl_rc_i`, `cf_chl_rc_ni`, `cf_chl_rc_m` (`cf_chl_rc_*`)	Cloudflare	Set and controlled by Cloudflare during a challenge to diagnose problems in the visitor’s browser.	No fixed lifetime is published in Cloudflare’s cookie reference.	Necessary/security

Bot Fight Mode is off, so its __cf_bm cookie and background JavaScript detections are not part of this release. Zaraz and Cloudflare Web Analytics are also off, as are all Managed Transforms. Browser controls can delete or block cookies, which may lead to another security challenge. Cloudflare explains the cookies in its cookie reference and Challenge Passage guidance. Security storage that is strictly necessary for the requested service is exempt from prior consent under LEK Chapter 9, Section 28; that exception does not authorise advertising storage.

Cloudflare Network Error Logging was switched off on 18 October 2026; new responses no longer install its browser reporting policy. A browser that received the earlier policy may still send network-diagnostic reports to Cloudflare for up to seven days from its last receipt. This reporting policy is separate from cookies; the privacy policy explains the processing.

Changing a choice

Open Cookie settings to change either switch or choose Reject all. A new grant waits for the server’s acknowledgement; withdrawal takes effect immediately, even if its evidence request fails and must be retried.

Withdraw Analytics: all four Consent Mode types become denied; the site deletes its first-party _ga/_ga_* cookies and Marketing storage it can delete. If Google loaded, the page reloads and Google stays blocked. A Marketing choice left on has no effect without Analytics.
Withdraw Marketing while keeping Analytics: the three advertising consent types become denied; the site deletes first-party _gcl_* and _gac_* cookies and the _gcl_ls localStorage key where present, then reloads if Google loaded. Analytics can restart with advertising denied.
Every rejection also cleans up applicable leftovers from expired or outdated choices. The same rules apply to other open tabs and pages restored with Back.

These cleanup names cover leftovers; they do not mean this stage sets all of them. Cookies on Google’s own domains need Google’s or your browser’s controls.

We record grants, changes and withdrawals on our server to demonstrate consent; a first-time Reject all creates no server record, ID or consent-record request, although its refusal can be saved in wm_consent. Evidence is deleted from the live database 15 months after the consent’s recorded end; if withdrawal cannot reach the server, retention runs from its six-month expiry instead. Backups, record access and erasure requests are explained under Consent records in the privacy policy.

Turning Analytics or Marketing off stops that purpose’s new collection in your browser immediately; earlier lawful processing remains lawful. Marketing cannot collect without Analytics. A withdrawal that reaches our server is recorded, including from an older notice version. Recording it does not automatically submit a deletion request to Google.

User-level and event-level measurement already stored in GA4 follows the 14-month retention setting in the privacy policy, with the two-month exception for age, gender and interests. Withdrawal does not restart that retention period. Google deletes data that reaches the end of the period in its monthly deletion process. Standard aggregated reports remain.

You can ask for earlier deletion by writing to support@crawle.io with the consent-record ID shown in Cookie settings while available, or an ID you saved before withdrawing or clearing your browser. We handle the request without undue delay and use Google Analytics’ User explorer → Delete user control to request deletion by hand, then confirm the action taken. If you no longer have the ID, you can still write to us and we will try to locate the data and help. We may not be able to find your GA4 data from your email address alone; please do not send unnecessary identifying or sensitive information. An ID used only for Marketing, with Analytics never allowed, has not been measured by GA4.

User deletion applies to the ID, not just one consent purpose, so deleting that ID can also remove its earlier Analytics-only history.

For deletions made in User explorer, Google says the data stops showing in that exploration within 24 hours and is permanently removed within the following 63 days. Those periods follow the deletion requested in User explorer, not your withdrawal click or email. Our confirmation of the action taken is not proof that Google’s erasure has finished. Already-aggregated reports remain.

A six-month choice expiry, a new notice version or a new ID alone does not request early deletion from Google; the retention setting still applies.

We keep the record ID and withdrawal/deletion-handling status with the consent evidence for the same live-database period; where a manual deletion is recorded, that includes its time. Backup copies follow the privacy policy. We do not keep a copy of deleted measurement. Our routine logs contain no consent/client IDs or request bodies. An erasure request for the proof itself is assessed individually: proof is retained only as necessary for a legal obligation or legal claims, with the reason explained to you.

Cookies from Crawle AB