TruBond Cookie Notice
Essential cookies secure the website and remember your privacy choice. First-party analytics are optional, off by default and never receive case details.
1. Plain-language summary
TruBond uses three first-party cookies. Two are essential for security and consent evidence; one readable preference cookie lets the website immediately honour your last choice. Optional analytics are sent only after acceptance.
2. Exact cookie inventory
| Cookie | Purpose | Category | Duration |
|---|---|---|---|
tb_csrf | Protects consent and analytics APIs from cross-site requests. Random token; not used for marketing. | Strictly necessary | 2 hours |
tb_consent_receipt | Signed, HttpOnly reference to the consent decision stored server-side. | Strictly necessary | 180 days |
tb_consent_choice | Remembers accepted or rejected status and the notice version so the banner can honour the choice. | Consent preference | 180 days |
No third-party analytics cookie, advertising cookie or cross-site identifier is used.
The server records privacy-preserving daily page totals and approximate unique visits without setting a tracking cookie. The daily one-way hash rotates every UTC day, contains no raw IP address and is not used to follow people across days. Optional interaction analytics described below still require consent.
3. Optional analytics
After acceptance, the website sends privacy-limited event records to a same-origin TruBond endpoint and stores them in the TruBond database. It does not use an external advertising network or session-replay service. Rejecting analytics leaves every public page and MyAccount CTA usable.
4. Cookie settings and withdrawal
Use “Cookie settings” in any page footer to accept, reject or withdraw optional analytics. Reject and accept are equally available. Withdrawal stops new optional events; previously aggregated statistics may remain where they no longer identify an anonymous browser.
5. Prohibited tracking
- Advertising pixels and cross-site behavioural profiling.
- Session replay, keystroke or cursor recording.
- Browser fingerprinting or precise geolocation.
- Camera, microphone, contact or local-file access.
- Capture of sensitive query-string values or DOM text.
- Data-broker matching, advertising enrichment or vendor model training.
6. Global Privacy Control
When the browser provides a recognised Global Privacy Control signal, optional analytics remain off and the interface explains that the signal was detected. The visitor can still inspect the settings.
7. Consent evidence
The server records the notice version, cryptographic notice hash, category decision, timestamp, anonymous receipt, request ID, daily network hash and withdrawal relationship. It does not attach the receipt to a case or MyAccount identity.
8. Changes
A new optional purpose or third party requires privacy and security review, an updated inventory and renewed choice. A material notice version change makes the site ask again.