Cookie and Tracking Notice

1. The Short Version

A cookie is a small file a site stores in your browser. A pixel, tag, SDK, or beacon does a similar job by loading a tiny resource from another company. All of them let a site remember something or measure something, and some of them let another company see that you were here.

On Banrox, the technologies needed to make the site work and keep it secure run without asking you. What happens with analytics, session replay and advertising measurement depends on where you are. For visitors in the United States, analytics and advertising measurement run by default until you opt out: they load from your first page and stay on until you choose Essential only in the banner, open the Do Not Sell or Share My Personal Information link in the footer, or send Global Privacy Control. This is the opt out that United States state privacy laws give you, and it costs you nothing. If you are anywhere else, or Banrox cannot tell where you are, none of those three loads until you choose Accept all.

There is one thing in between and Banrox names it here rather than leave you to find it. Banrox measures, on its own servers, which pages and which elements of a page were used. That measurement is first party, it carries no field contents, no other company receives it, and it runs whatever you choose in the banner because it is part of how Banrox keeps the service working and detects abuse. It is described in full in section 3.

What that means in practice. Outside the United States, no analytics tool, no advertising measurement, no session recording and no social pixel loads on your first visit unless and until you accept it. In the United States they load by default, and Essential only, the Do Not Sell or Share My Personal Information link, or a Global Privacy Control signal switches them off. Either way, declining costs you nothing: every feature on this site works with only the strictly necessary category enabled.

Global Privacy Control is honoured before you are asked anything. If your browser sends a Global Privacy Control signal, Banrox reads it as your answer before the banner would have appeared. No banner is shown, no session replay loads, no analytics loads, and no advertising measurement loads. You do not have to click anything, and Banrox does not ask you again.

2. The Categories We Use

What each button in the banner does. Banrox uses Google Consent Mode version 2. Outside the United States it starts denied: before you answer, advertising storage, advertising user data, advertising personalisation and analytics storage are all set to denied, so nothing in the last three rows of that table runs, and Accept all is what grants all four. In the United States those four start granted, because state privacy law lets measurement run until you opt out, so the last three rows run from your first page. In both places, choosing Essential only denies all four and keeps them denied, and a Global Privacy Control signal does the same before the banner is ever shown. Essential only, or Global Privacy Control, also stops the advertising pixels named in section 3 and removes the cookies they set, on the page where you choose it and on every page after. The Do Not Sell or Share My Personal Information link in the footer opens the same Essential only choice.

3. The Companies That Run These Technologies, and Banrox's Own Measurement

Microsoft Clarity, Google Analytics 4 and the advertising pixels of six networks are what your choice in the banner is about, and two more companies run under the strictly necessary category whatever you choose. Banrox names all of them here instead of describing them as categories, and the same names appear at Service Providers and Data Recipients with what each one is barred from doing.

• Microsoft Clarity. Session replay and heat maps, which together are a reconstruction of how a page was used. In the United States it loads by default until you choose Essential only or send Global Privacy Control; anywhere else it loads only after you choose Accept all. When you are signed in, Banrox gives Clarity a one way SHA-256 hash of your email address, cut to 32 characters, so that two visits by the same member can be recognised. The address itself never leaves the page and cannot be worked back out of the hash.
• Google Analytics 4. Measurement of which pages and journeys were used and how often. In the United States it loads by default until you choose Essential only or send Global Privacy Control; anywhere else it loads only after you choose Accept all. Banrox links measurement across banrox.com and its quiz sites at quiz.banrox.com and banrox-quiz.pages.dev, so that one visit across those domains is counted once rather than three times. Accepting also turns on the advertising features inside Google Analytics 4, which is why the choice is worth reading before you make it.
• Advertising networks: Google Ads, Meta, TikTok, Reddit, Microsoft Advertising and LinkedIn. In the United States each one's pixel loads by default until you choose Essential only or send Global Privacy Control; anywhere else it loads only after you choose Accept all. None of them loads on a page that asks for a Social Security number, a date of birth, income or an account number, on sign up, sign in or password reset, or on any page you see while signed in. The pixel tells the network that you came to Banrox, or signed up, after seeing one of its adverts, so Banrox can stop paying for adverts that do not work, and it lets that network show you a Banrox advert elsewhere. The network receives the address of the page, your browser's own details and the name of the event, and it may set its own cookie. Banrox does not send any of them your name, email address, telephone number, or any identifier derived from them.
• The advertising click id. When you arrive from an advert, the network puts its own identifier on the link, such as Google's gclid or Microsoft's msclkid. In the United States Banrox keeps that identifier for ninety days and stores it with a Squad waitlist signup unless you opt out; anywhere else Banrox keeps it only if you choose Accept all. It is kept for one purpose: telling the network that its advert produced a signup, so Banrox can stop paying for the ones that do not. It is never combined with your credit report, your score or anything you have applied for, it is not used to build a profile of you, and your name, email address and telephone number are never sent with it. Choose Essential only, or send Global Privacy Control, and it is not kept at all; accept and then change your mind, and it is deleted on your next page view.
• Cloudflare. Network edge protection, and the Turnstile check on the squad signup form. This is strictly necessary security and it runs before consent.
• Fingerprint and IPQualityScore. Device and network risk signals on sign in, sign up and form endpoints. Strictly necessary security, described in section 4.

Banrox's own measurement, in full. Banrox runs a first party behaviour collector on its own pages. It records which pages and which elements of a page were used and sends that to Banrox's own server at /api/telemetry. It carries no field contents. It is not a third party tool, no other company receives it, it is not sold, it is not shared, and it is not used for advertising or for any advertising profile. It feeds the fraud and abuse checks and Banrox's own internal reporting on where the site is failing people. It runs whatever you choose in the cookie banner, as a security and integrity measure, and you cannot switch it off from the banner. If you want to know what it recorded about your visits, or you object to it, write to [email protected] and Banrox will answer.

The full list of the companies that receive personal information from Banrox, in any part of the service and not only from this site, is at Service Providers and Data Recipients. If a technology runs here that is not named on either page, that is a fault in these pages. Report it to [email protected] and Banrox will correct the page and tell you what it found.

4. What We Do Not Do

• No analytics, session replay, heat map or advertising technology on this site receives what you type into a field. Those tools mask field contents in your browser before anything is sent. Banrox marks the sign in and sign up steps, and any form carrying a password, a telephone number, a Social Security number, a date of birth, an account or routing number or an income figure, as a masked block, labels included, on top of the masking the tool does itself. This is different from the information you deliberately submit to Banrox, such as a form you send, a quiz answer or a document you upload, which Banrox does receive and store as described in the Privacy Policy.
• Banrox does not load an advertising or analytics tag on any page where you are viewing your credit report, your score, your identity alerts, or your account details. Those pages carry strictly necessary technologies only. Banrox keeps every non-essential tag out of those routes in its own code rather than in a tag manager setting, and checks those routes before each release. If you find a tag on one of those pages, report it to [email protected] and Banrox will remove it and tell you when it was added and what it saw.
• Banrox does not pass your name, email address, telephone number, or any identifier derived from them to an advertising network. The only derived identifier that leaves the page at all is the hashed member identifier described in section 3, which goes to the session behaviour tool and to no one else. The one exception is a Meta lead form, which is not on this site: Banrox tells Meta which sign-up steps a lead completed, as described under Meta lead forms in the Privacy Policy.
• Banrox does not use device fingerprinting for advertising, for profiling, or for anything to do with what you buy or read. Banrox uses device and network signals only to protect the service and its users from bots, credential stuffing, denial of service and account takeover. California law expressly permits a provider to use these signals for the operation and protection of its own service and to protect its users from abuse of the service, at California Penal Code section 638.51(b). These signals run on the sign in page, the sign up page and form endpoints. They are not linked to an advertising profile, they are not sold, and they are not shared with any advertising network.
• Banrox does not sell cookie derived data.

5. How to Change Your Mind

• Cookie Settings. A Cookie Settings link sits in the footer of every page, for signed out visitors as well as members. It reopens the banner with your current choice shown, so you can change it. Withdrawing is exactly as easy as consenting, and it takes effect immediately.
• Global Privacy Control. Banrox honours the Global Privacy Control signal from every visitor in every state. Banrox also honours any other browser level opt out mechanism that a state regulator adds to its published list of recognised mechanisms, and Banrox checks those lists at least twice a year. Banrox treats the signal as a refusal of analytics, session behaviour and advertising, and as an opt out of sale and sharing, and it does not ask you again.
• Your browser. Every major browser can block or delete cookies. Blocking strictly necessary cookies will break sign in.
• Where your choice is stored. Your choice is stored in the browser you made it in, so it is per browser and per device. If you clear your site data or use a different browser, Banrox asks you again rather than assume the old answer.

Banrox does not respond to legacy Do Not Track browser headers, because the industry never agreed a standard for what a site should do with one. Banrox says so here rather than stay silent about it. Global Privacy Control is the signal that works.

6. Chat, Support Tools and Call Recording

Live chat. There is no live chat or support widget on Banrox today, and no chat vendor receives anything about you, because there is nothing to receive. If Banrox adds one, the provider will be named on this page and at Service Providers and Data Recipients before the widget goes live, and the notice will appear in the chat window before your first message rather than only here.

Call recording. Banrox does not record a call unless you are told at the start of that call, before any recording begins. That applies to every call, inbound and outbound. If you do not want the call recorded, say so and the recording stops, and you lose nothing by asking. Where a call is recorded, Banrox keeps the recording for 5 years, and the telephony provider named at Service Providers and Data Recipients carries and stores it under a contract that bars any use of its own.

7. Why This Page Exists

Website tracking is regulated by state privacy statutes, by the California Invasion of Privacy Act and equivalent state wiretap laws, and by the Federal Trade Commission Act. Those laws turn on what a visitor was told and what a visitor agreed to. This page exists so the answer to both questions is on the record, in language a person can actually check against what the site does.

If you believe a technology on this site is doing something this page does not describe, write to [email protected]. Banrox will look, and if the page is wrong Banrox will fix the page or the tag, and tell you which.