Cookie Policy — Dumpbox

dumpbox_session — HTTP cookie, httpOnly, 14 days. Keeps you signed in. Strictly necessary, does not require consent.

PostHog (EU Cloud) — product events, pageviews, errors. Cookieless mode: localStorage, no cookies.

Microsoft Clarity — heatmaps and visual session recording (session replay).

Google Analytics 4 — traffic statistics and referral source.

Google Ads — measures which ads lead to a sign-up. It rides on the same gtag.js as Analytics and writes the_gcl_au cookie.

Meta Pixel — the same for Instagram and Facebook campaigns.

The last two do more than count: with your consent they let Google and Meta personalise the ads you see, including outside Dumpbox, and build remarketing audiences.

None of these load until you choose "Accept analytics" above or in the banner.

If you choose "Ignore", the five tools above do not start. What stays on is the Google tag alone, and in a denied state across all four Consent Mode signals. Concretely: no cookie written or read — neither _ga nor _gcl_au — no measurement identifier, and ads are not personalised.

Only the bare name of each event goes out, never the properties attached to it: "somebody signed up", never who. This is not a matter of principle — without that subtraction your username, and even other people's, would go out with it.

The part we cannot remove, and would rather write down for you: to count, a request to Google does go out, and like every request on the web it carries your IP address and the browser you use. Google uses it to derive an approximate location and does not retain it in the reports. That is why we don't tell you it is "completely anonymous": it is counting without identifiers, which is a precise and different thing.

Until you choose — banner still open, or never answered — nothing at all goes out, exactly as before.

If you arrive from an ad or a link on Instagram or Facebook, the page opens in the app's built-in browser. At sign-in we offer to continue in your usual browser, because a sign-in created inside an app stays inside that app: the next day, opening dumpbox.ai from Chrome or Safari, you would no longer be logged in.

That offer uses no cookies and no browser storage. It reads only the string your browser already sends with every request (the user agent) and reassembles the address of the page you are on. Nothing is written or read on your device, no identifier is created, no third-party service is contacted — which is why the panel appears even if you have not chosen yet, or if you chose "Ignore".

If you tap "Copy the link", the address goes to your device's clipboard: you do that, and we do not read it.

For the five tools: consent (Art. 6(1)(a) GDPR, Art. 122 Italian Privacy Code), revocable at any time via the panel above, without affecting the lawfulness of processing already carried out before withdrawal.

For the anonymous count: legitimate interest (Art. 6(1)(f) GDPR) in knowing how many people use the service. Art. 122 requires consent to store or read information on your device, and here neither happens. You can object at any time by writing to privacy@dumpbox.ai.

For details on the data collected, see the Privacy Notice.

privacy@dumpbox.ai