Privacy And Cookie Consent

Privacy owns the versioned visitor choice, preferences dialog, footer access, required Google Analytics disclosure, and consent checks that govern first-party attribution cookies.

On this page

Where to look

AreaMaintainer reference
Consent contract
Implementation referencesrc/features/privacy/shared/cookie-consent.ts
Consent UI
Implementation referencesrc/features/privacy/ui/cookie-consent.tsx
Preference access
Implementation referencesrc/features/privacy/ui/cookie-preferences-button.tsx
Application wiring
Implementation referencesrc/app/layout.tsx, src/app/(marketing)/_components/marketing-footer.tsx
Request enforcement
Implementation referencesrc/proxy.ts, src/lib/tracking/utm.ts
Storage names
Implementation referencesrc/config/app-identity.ts
Implementation reference3 areas

These Product code locations explain how the documented behavior is implemented. Expand them when you are ready to customize or maintain this area.

Versioned decision

The shared contract serializes accepted or declined decisions into a versioned cookie that both browser UI and request code can parse.

  • src/features/privacy/shared/cookie-consent.ts
  • src/config/app-identity.ts

Visitor controls

The banner offers Accept and Customize choices; the footer can reopen saved preferences without erasing the prior decision.

  • src/features/privacy/ui/cookie-consent.tsx
  • src/features/privacy/ui/cookie-preferences-button.tsx

Attribution enforcement

The request proxy creates first-touch, last-touch, landing, and session attribution cookies only after acceptance and clears old values when attribution is disabled.

  • src/proxy.ts
  • src/lib/tracking/utm.ts

Reference paths are relative to the Shipflash-Product checkout.

Privacy rules

  • Do not record a decision when Customize is opened or dismissed.
  • Keep required Google Analytics, session, and security cookies separate from optional attribution.
  • Use the configured website brand name in visitor-facing consent copy.
  • Clear optional cookies when a visitor saves preferences with attribution disabled.
  • Increment the consent version only when purposes materially change and re-consent is required.
  • Review every new analytics provider for script, cookie, data-transfer, and regional-consent requirements.