Legal
Cookie Policy
Last updated: 1 August 2026
1. What this Policy covers
This Cookie Policy explains how Headshot Marketing Pvt. Ltd. ("GGNomad", "we", "us") uses cookies, local storage, session storage, IndexedDB, pixels, web beacons and similar technologies ("cookies") on the GGNomad website at ggnomad.com, the product frontend at app.ggnomad.com, and the GGNomad mobile applications (where they store local state). It supplements our Privacy Policy. The full, binding legal text is maintained at github.com/algoshred/ggnomad-specs.
2. What cookies are, and how we categorise them
A cookie is a small text file stored on your device by your browser. We use four categories:
- Strictly necessary — required to operate the site or product (authentication, security, load balancing, CSRF, cookie-consent state). You cannot opt out of these and still use the Service.
- Functional — remember your preferences (theme, language, last tenant / workspace) so the product behaves the way you set it up.
- Analytics / performance — measure how the site and product are used via our self-hosted Rybbit instance so we can fix bugs and prioritise improvements. We export this data for our own analysis and do not sell it.
- Marketing — measure the effectiveness of our waitlist and marketing campaigns. We do not use cookies to share data with third-party advertising networks for cross-context behavioural advertising.
We do not use cookies or trackers to profile travelers, guests or hosts for advertising — analytics measure how the software is used, not who to target.
3. The cookies we set
| Cookie / storage key | Set by | Category | Purpose | Duration |
|---|---|---|---|---|
| cf_session, cf_csrf | GGNomad (first-party) | Strictly necessary | Authenticated session and CSRF protection | Session / 14 days |
| cf_consent | GGNomad (first-party) | Strictly necessary | Records your cookie-consent choices | 12 months |
| cf_tenant, cf_locale, cf_theme | GGNomad (first-party) | Functional | Last tenant / workspace, language, theme | 12 months |
| LocalStorage: cf_ui_state | GGNomad (first-party) | Functional | Persists UI state (tabs, sidebar, scroll) | Until cleared |
| __cf_bm, cf_clearance | Cloudflare | Strictly necessary | Bot management, WAF challenge state | Up to 30 days |
| Rybbit analytics identifiers | Rybbit (self-hosted by GGNomad) | Analytics | Aggregate, de-identified product and website analytics | Up to 13 months |
The exact names above may evolve as the product develops; the categories and providers will not change without notice. We do not load third-party advertising cookies, retargeting pixels, social-network "share" pixels that load without consent, or fingerprinting beyond what Cloudflare uses for bot mitigation.
4. Rybbit — our product and website analytics
We use Rybbit as our analytics tool. We run a managed-cloud Rybbit subscription that we operate ourselves; Rybbit is not given commercial access to your data.
- Events recorded include page views, searches, listing views, booking-funnel steps, error counts, and aggregate funnel data — keyed by an internal account / device identifier.
- We may export analytics data for our own analysis and dashboarding. We do not sell analytics data or user-level behavioural profiles to any third party, and we do not share user-level analytics with advertising networks.
- Where analytics processing involves cookies or similar storage on EEA / UK / Swiss visitors' devices, it requires consent — see Section 5.
5. How we ask for consent
- EEA, UK and Switzerland. On your first visit we show a banner that lets you Accept all, Reject non-essential, or open preferences to consent category-by-category. Non-essential cookies are not set until you consent.
- India. We rely on a layered notice — this Cookie Policy plus the banner — consistent with the Digital Personal Data Protection Act, 2023 and the IT Act, 2000 SPDI Rules.
- California and other US states. We honour Global Privacy Control (GPC) signals as opt-out signals for "sale" or "sharing" to the extent state laws require. We do not sell personal information.
- Rest of world. We apply the broader of any local requirement and the EEA standard above where lawful.
6. Controlling cookies
You can:
- Adjust your choices in our cookie preferences centre;
- Delete or block cookies through your browser settings (strictly necessary cookies cannot be disabled without breaking the Service);
- Use browser features like Private / Incognito mode or anti-tracking lists;
- Transmit a Global Privacy Control signal — we honour it as a US opt-out signal.
7. Do Not Track
There is no industry consensus on "Do Not Track" (DNT). We do not currently respond to DNT signals, but we honour Global Privacy Control as set out in Section 5.
8. Changes to this Policy
We may update this Cookie Policy from time to time. For material changes that introduce new tracking categories or providers, we will re-prompt EEA / UK / Swiss visitors for consent and notify account holders by email or in-product banner. The current version is always at ggnomad.com/cookies.
9. Contact
Questions about cookies and tracking: [email protected]. For our full registered details and grievance officer, see the Privacy Policy.