01Nothing loads until you agree
When you first arrive, the site asks one question: may we count your visit. Until you answer it, and for as long as the answer is no, no analytics cookie is set and no request is made to Google at all.
That last part is the bit usually skipped. Most sites load the analytics script immediately and switch measurement on afterwards — but fetching the script already tells Google your IP address and which page you were reading, before you have agreed to anything. Here the script is not requested until you accept.
Refusing is one click, in a button the same size as the one that accepts. Ignoring the banner has the same effect as refusing; the only difference is that a recorded refusal means you are not asked again.
02What Google Analytics does here
It counts visits: which pages are read, roughly where in the world the reader is, whether they arrived from a search engine or a link, and whether the site worked on their screen size. It exists so we can tell which parts of the documentation are worth expanding and which pages nobody ever reaches.
It is not used to build a profile of you, to advertise to you, or to follow you to other sites. Advertising features, ad personalisation and Google Signals are switched off in the configuration, not merely left unused.
If you accept, these cookies are set on this domain:
| Cookie | What it is for | Expires after |
|---|---|---|
| _ga | Google Analytics. Distinguishes one browser from another so that two visits from you are not counted as two people. | 6 months |
| _ga_XXXXXXXXXX | Google Analytics. Holds the state of the current visit — when it started, and whether it is still the same one. | 6 months |
Six months rather than Google’s default of two years. A shorter life is enough to answer "how did last quarter compare", which is the only question being asked of it.
- Who receives it
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, as our processor under a data processing agreement.
- Where it goes
- Processing takes place in the EU, and Google may transfer data to the United States. Google LLC is certified under the EU–US Data Privacy Framework, which is the adequacy decision that transfer relies on.
- Legal basis
- Your consent — Art. 6(1)(a) GDPR, and the prior-consent requirement of the ePrivacy rules for anything stored on your device that is not strictly necessary.
- What Google gets
- Your truncated IP address, the pages you viewed, and the cookie identifiers above. GA4 does not record or store full IP addresses.
03What is on your device either way
Separately from the above, and regardless of what you answered, the application keeps a few things in your browser’s local storage. None of it is a cookie, none of it is sent to a third party, and all of it either signs you in or remembers a setting you chose yourself.
| Key | What it is for | Kind |
|---|---|---|
| sop_token | The token that keeps you signed in. Removed when you sign out. | Necessary |
| sop_org | Which organization you are currently working in. | Necessary |
| sop_consent | Your answer to the analytics question, and when you gave it. Kept so that a refusal is not asked again on every visit — which is also why removing it brings the question back. | Necessary |
| sop_last_org_slug | The handle of the organization you last signed into, so the sign-in form can pre-fill it. | Convenience |
| sop_locale | Whether you are reading the site in English or Croatian. | Preference |
| sop_theme | Whether you chose the light or the dark theme. | Preference |
| sop_timezone | The timezone your dates are shown in. | Preference |
| sop_dateformat | How you asked for dates to be written. | Preference |
| sop_eq_view, sop_tpl_view, sop_facility_view, … | Whether you last looked at equipment, templates and sites as cards or as a list. | Preference |
Only the sign-in token leaves your machine, and only back to this application, because proving who you are is what it is for.
The site still loads nothing else from another domain. The three typefaces it uses are served from this application rather than from Google Fonts, which is the usual way a site with no trackers still ends up sending every visitor’s IP address to one.
04Changing your mind
Use the “Cookie settings” link at the bottom of any page. It asks the question again, and your new answer replaces the old one.
Withdrawing consent stops the measurement and deletes the analytics cookies from your browser immediately. It cannot reach back and remove what was already collected while consent was in force — for that, use the contact route in the privacy policy and we will ask Google to delete it.
Withdrawing is deliberately the same number of clicks as consenting. If it were harder, the consent would not have been freely given in the first place.
05Getting rid of all of it
Signing out removes the token and the organization. The preferences stay, so the site looks the way you left it next time.
To remove everything, clear site data for this domain in your browser — in most browsers that is under the padlock in the address bar, or in the privacy section of settings.
Nothing breaks if you do. The next visit starts from the defaults, and the analytics question is asked again because the record of your answer went with the rest.
Browser-level controls work too: a "do not track" preference, a tracker blocker or an extension that blocks googletagmanager.com will all prevent the measurement, and nothing on this site will nag you about it or work any worse for it.
06The rest of it
What happens to data once it is inside the application — who is responsible for it, how long it is kept, and what rights you have over it — is in the privacy policy.