Current use
The website uses first-party technologies needed for security, forms, session continuity and authenticated Admin access. It also offers optional Google Analytics 4, which remains completely unloaded unless a visitor selects Accept analytics.
Reject analytics is presented alongside Accept analytics. The footer Cookie settings control can reopen the choice. Reject, withdrawal and an enabled Global Privacy Control signal keep Google Analytics blocked.
fusionaura-studio-session
Purpose: session continuity, CSRF and security controls, form integrity, and authenticated Admin state where applicable. Category: strictly necessary / essential.
The cookie contains an opaque session identifier; associated server-side session data may include technical request information and an Admin user identifier after authentication. The configured idle lifetime is 30 minutes and may refresh during activity. It is configured HttpOnly, Secure on HTTPS, SameSite Lax and encrypted at the application level.
The exact name, expiry, domain, path and security attributes may vary with the deployed environment and can be inspected in the browser’s storage and response-header tools.
XSRF-TOKEN and form CSRF state
Purpose: protection against cross-site request forgery and preservation of form and security integrity. Category: strictly necessary / essential.
Laravel may issue the first-party XSRF-TOKEN cookie and embeds hidden CSRF state in protected forms. The token is framework security state tied to the session, not advertising or analytics data. Its intended lifetime follows the configured session window; exact production headers and deletion behavior must be verified before launch.
Related server-side security state
Rate-limit counters, duplicate-submission controls, queued-job identifiers and TOTP challenge state are maintained server-side to protect inquiries, privacy requests and Admin access. They are not browser advertising storage. TOTP secrets and recovery codes are not exposed in public cookies.
fusionaura_analytics_consent
Purpose: remember whether optional analytics was accepted or rejected. Category: preference / consent record. Owner: FusionAura Studio, first party.
The cookie stores only the consent-version number and either granted or denied. It does not contain a name, email, inquiry content or advertising identifier. It lasts for 180 days, uses SameSite Lax, and uses Secure when the page is served over HTTPS.
Google Analytics 4 cookies and events
Provider: Google LLC. Purpose: optional measurement of page views and approved interactions such as project, contact, email, phone or WhatsApp actions and a successfully created project inquiry. Measurement ID: G-2WNCVZLXXW. Category: analytics / non-essential.
After consent, Google Analytics may set first-party cookies including _ga and a property-specific _ga_ cookie. Google documents a default duration of up to two years, subject to property, browser and user controls. This implementation disables Google Signals and advertising-personalisation signals, denies all advertising consent types, removes URL query strings from the configured page location, and never sends Contact-form fields as event parameters.
With Basic Consent Mode, the Google script is not requested and no Analytics ping, cookie, page_view or custom event is sent before Accept. Withdrawing consent disables future site events and attempts to remove accessible first-party Google Analytics cookies. Browser or network controls may also block Google independently.
Technologies not currently active
The current audited source does not use localStorage, sessionStorage, IndexedDB, service-worker caches, advertising pixels, fingerprinting, remarketing, session replay or tracking query-parameter persistence. Google Tag Manager is not installed. Hostinger CDN is not activated by this application work and its real production configuration remains an account-level decision.
Before other non-essential technology is added
Before Google Tag Manager, advertising tags, Meta Pixel, LinkedIn Insight Tag, TikTok Pixel, Hotjar, Microsoft Clarity, session replay, remarketing, behavioural advertising, non-essential third-party embeds or comparable browser storage is enabled, FusionAura Studio must stop and repeat the storage and privacy assessment.
The current single analytics choice does not authorize advertising, remarketing or unrelated third-party tools. Any future purpose must be assessed and, where required, receive a separate appropriately granular choice before activation.
Browser controls and contact
Use Cookie settings in the footer to accept, reject, withdraw or review optional analytics. When Global Privacy Control is enabled, this implementation treats it as a rejection and disables the Accept analytics control while that signal remains active.
Browser settings can remove or block cookies, but blocking essential session or CSRF technologies may prevent forms or Admin authentication from working correctly.
Questions about this notice can be sent to hello@fusionaurastudio.com. Privacy questions can also use the existing privacy-request process.
Changes to this notice
This notice will be reviewed whenever browser storage, tracking, embeds, infrastructure or applicable legal facts change. The public page shows when the current notice was last updated.