Cookie & tracking policy
On this page
- No advertising or social-media plug-ins. Fonts, scripts and images are served from this site. On the website, when experimentation is enabled and you opt into Analytics, measurements go to our Tractrix Cloud service in the EU.
- No fingerprinting, no tracking pixels in our e-mails and no telemetry in the desktop add-ins.
- We do not sell or share personal information, and we do not use it for targeted advertising.
- Remembering your “Was this page helpful?” answers and website experiment measurement are optional and require separate Preferences and Analytics consent. Rejecting is as easy as accepting, and nothing optional runs until you choose.
Your current choices: JavaScript is off, so nothing optional can run.
What cookies and similar technologies are
This policy covers every technology that stores information on, or reads information from, your device, not only cookies. That is how EU, UK and Swiss law define the scope (ePrivacy Directive Art. 5(3), PECR regulation 6, Swiss Telecommunications Act Art. 45c; see also EDPB Guidelines 2/2023 on the technical scope of Art. 5(3)).
- Cookies
- Small text files a website asks your browser to keep and send back with later requests. The Tractrix website sets none. Tractrix Cloud sets one (below).
- Local storage and session storage
- Browser storage that only scripts on the same site can read. Nothing is sent to a server automatically. The website uses local storage for the items in the inventory, and no session storage.
- Pixels and web beacons
- Tiny images or requests that report that a page or e-mail was opened. We use none.
- SDKs and telemetry
- Code in apps or plug-ins that reports usage. The Tractrix desktop add-ins contain none (below).
- Fingerprinting
- Recognising a device from its characteristics (fonts, screen, browser settings) instead of stored identifiers. Tractrix does not fingerprint. The consent manager reads your time zone and browser language on your device only, to choose which regional notice to show; it keeps nothing but the chosen region and sends nothing anywhere.
What the website stores
This is the complete list for this website. The consent manager's own list (assets/js/consent.js) is checked against this table by our automated tests.
| Name | Provider | Purpose | Category | Duration | Type |
|---|---|---|---|---|---|
| tx_consent | Tractrix (first party) | Records your cookie choices so we respect them and do not ask on every page. Holds the policy version, time, categories, region, how the choice was made and a random ID that is not linked to you. | Strictly necessary | Until you clear it; we ask again after 6 months or when this policy's version changes | localStorage |
| tx-theme | Tractrix (first party) | The light or dark theme you picked with the theme switch. Written only when you press the switch. | Strictly necessary (requested by you) | Until you clear it or press the switch again | localStorage |
| tx-lang | Tractrix (first party) | The website language you chose with the language switcher, or by answering the “also available in …” suggestion, so we link you to that language and stop suggesting another one. Written only when you make that choice. Never used to redirect you automatically. | Strictly necessary (requested by you) | Until you clear it or choose another language | localStorage |
| tx-exp-visitor | Tractrix (first party) | Stable assignment to website variants and consented measurement; only on all supported language pages with experimentation enabled. | Analytics (consent) | 30 days or until withdrawal | localStorage |
| tx-fb:<page path> | Tractrix (first party) | Your “Was this page helpful?” answer for that page, so the page shows it next time. Never sent to us. | Preferences (consent) | Until you withdraw consent (then deleted at once) or clear it | localStorage |
Analytics and marketing: Marketing is not used. When enabled on the website, Analytics compares page configurations using a random browser identifier, variant assignment, qualified CTA clicks, active time in view, animation completion, error flags and loading/responsiveness measurements. No account details, typed content, full browsing history or fingerprint are collected by this system. Your identifier expires after 30 days; server-side pseudonymous measurements are deleted after 90 days. Aggregate decision reports are retained. Withdrawing consent stops measurement and deletes the local identifier. Already collected data expires on its retention schedule. New consent takes effect for experimentation on your next page visit.
Categories and why we classify them this way
| Category | In use | Default | EU / EEA, UK, Switzerland | United States |
|---|---|---|---|---|
| Strictly necessary | tx_consent, tx-theme, tx-lang | Always on | Exempt from consent: strictly necessary for a service you requested (ePrivacy Art. 5(3); PECR reg. 6(4)(b)). Any personal data: legitimate interests / legal obligation to record consent (GDPR Art. 6(1)(f), 6(1)(c), 7(1)) | Not a sale or share; used only to provide the site |
| Preferences | tx-fb:… | Off until you opt in | Consent (GDPR Art. 6(1)(a)) | Not a sale or share; first party only |
| Analytics | Website experiments, when enabled on all supported language pages | Off | Opt-in consent | Opt-in; GPC and DNT honoured |
| Marketing | None | Off; not offered | Would require consent | Would be opt-in; GPC would switch it off |
Why the consent record is strictly necessary
Without tx_consent we could not respect a refusal: the banner would reappear on every page and we could not show that we asked. EU and UK regulators treat storage that records a consent choice as strictly necessary (Article 29 Working Party Opinion 04/2012; CNIL guidelines of 17 September 2020; ICO guidance on storage and access technologies). It stays on your device; it is not sent to us.
Why the theme and language choices are treated as requested by you
Why “Was this page helpful?” needs consent
Answering the question works without storage. Remembering the answer on later visits is a convenience you did not strictly ask for, so we store it only if you allow Preferences. If you withdraw that consent, every tx-fb: entry is deleted at once.
Tractrix Cloud web app
The Tractrix Cloud app (preview) is a separate web application. It uses only strictly necessary storage, needed to keep you signed in to the service you asked for, and loads its fonts, scripts and images from its own server.
| Name | Provider | Purpose | Category | Duration | Type |
|---|---|---|---|---|---|
| tx_refresh | Tractrix (first party) | Keeps you signed in. A random token (stored only as a hash on our side), rotated every time it is used; reuse of an old token revokes the whole sign-in. HttpOnly (scripts cannot read it), SameSite=Strict, Secure in production, and sent only to /api/auth. | Strictly necessary | 30 days from last use, or until you sign out | Cookie |
| tx.currentOrg | Tractrix (first party) | The workspace (organisation) you last selected, so the app opens it next time. An internal ID, not your name or e-mail. | Strictly necessary (requested by you) | Until you clear it | localStorage |
The 15-minute access token is held only in memory and disappears when you close the tab. The app has no analytics or marketing technology, so it shows no consent banner. The interactive API reference at /api/docs currently loads the Swagger UI viewer from a third-party CDN (cdn.jsdelivr.net) when you open it, which exposes your IP address to that CDN; [we plan to serve these files ourselves before general availability].
Desktop add-ins and plug-ins
Tractrix for QGIS, the OpenAirside engine and the AutoCAD and Revit add-ins contain no telemetry, analytics or crash reporting and make no network requests of their own. We checked the source: the only network client in the add-ins is the Tractrix Cloud engine connector. It runs only when you select the cloud engine in the add-in settings (the default is the local engine) and have agreed to the data-transfer notice the add-in shows first; it then sends the simulation request to the Tractrix Cloud address you entered. You can withdraw that agreement in the add-in settings, which also deletes the stored API token. Settings, including that answer, are stored in %AppData%\Tractrix\settings.json on your computer. Links to legal pages open in your browser only when you click them.
Tractrix Cloud sends service e-mails (for example address confirmation, password reset, invitations and account notices) and, only if you opt in, product news. All are plain text: no images, no tracking pixels, no open tracking and no rewritten or tracked links. Product news carries a one-click unsubscribe link; the token in it identifies your subscription only so that the unsubscribe works, and is not used to track reading. [If open or click tracking is ever introduced, it will be described here and require consent where the law says so.]
How consent works on this website
- Nothing optional before you choose. Optional scripts are delivered inert (as
type="text/plain") and switched on only after consent for their category. This applies everywhere in the world, whatever region is detected. - An equal choice. The first message offers Accept all, Reject all and Customise as buttons of the same size and style. Nothing is pre-ticked, the site works fully whatever you choose, and there is no cookie wall.
- Closing counts as “no”. Closing the message with Esc or the × button rejects everything optional.
- Specific. Customise lists each category, what it is for and every item it stores, with a separate switch.
- Re-asked, not nagged. We keep your choice for 6 months, then ask again (CNIL recommendation; never longer than 12 months). We also ask again whenever this policy's version changes.
- Withdrawal as easy as consent. Cookie settings is in the footer of every page and at the top of this page. When you switch a category off, what it stored is deleted at once; if one of its scripts was already running, the page reloads so that it stops.
- Recorded. Your choice is stored in
tx_consentwith the policy version, time, categories, region, method (banner,preferencesorgpc) and a random ID. The record stays in your browser; Cookie settings shows its date and ID if you ever need to refer to it.
How your region is chosen
To show the right notice and links, the consent manager estimates your region from your device's time zone and browser language, on your device, without any network look-up. It only changes wording and links (for example, US visitors see “Your privacy choices” and “Notice at collection”); the protection is the same everywhere. You can pick another region in Cookie settings.
Global Privacy Control and Do Not Track
If your browser sends a Global Privacy Control (GPC) signal, we treat it as a request to opt out of the sale and sharing of personal information, targeted advertising, and all analytics and marketing, on every visit and in every region. The banner and the settings show “GPC signal honoured”, and those categories cannot be switched on while the signal is present. We treat the older Do Not Track signal the same way. Your status: shown here when JavaScript is on.
What applies where you are
European Union and EEA
Storing or reading information on your device needs your prior consent unless it is strictly necessary for a service you requested (ePrivacy Directive 2002/58/EC, Art. 5(3), as implemented in each member state). Consent must meet the GDPR standard: freely given, specific, informed, unambiguous, as easy to withdraw as to give (GDPR Art. 4(11) and 7). We follow the EDPB Cookie Banner Taskforce report (2023) and Guidelines 03/2022 on deceptive design patterns: a reject option on the first layer, no pre-ticked boxes, no misleading colours or wording. You may complain to your data protection authority.
United Kingdom
Switzerland
The revised Federal Act on Data Protection (nFADP, in force since 1 September 2023) and Art. 45c of the Telecommunications Act require clear information and a way to refuse. We go further and ask for opt-in consent. You may contact the Federal Data Protection and Information Commissioner (FDPIC).
United States
Canada, including Québec
PIPEDA requires meaningful consent, and the Office of the Privacy Commissioner expects express consent for less expected uses. Québec's Law 25 requires technologies that can identify, locate or profile you to be switched off by default (Act respecting the protection of personal information in the private sector, s. 8.1). Our defaults meet both: everything optional is off until you switch it on.
Brazil
Under the LGPD (Lei 13.709/2018) and the ANPD's guidance on cookies (2022), we rely on your consent for anything that is not strictly necessary, and you may withdraw it at any time, free of charge. You may contact the ANPD.
South Africa
Under POPIA (Act 4 of 2013), processing must be lawful and minimal, and consent must be voluntary, specific and informed. Optional storage runs only with your consent. You may contact the Information Regulator.
Rest of the world
Wherever you are, optional storage stays off until you opt in, and you can change your choice at any time. If local law gives you additional rights, contact us and we will honour them.
Changing or withdrawing your consent
Use Cookie settings in the footer of any page, or the button at the top of this page. Switch a category off and press Save choices, or press Reject all. Items in that category are deleted immediately. Withdrawing consent does not affect anything done before, while consent was in place. For requests about personal data we hold, use the privacy request form.
Browser controls
You can also delete or block storage in your browser: clear the site data for this website (this also resets your consent choice, so you will be asked again), block cookies, or browse privately. Most browsers explain how in their help pages under “site data” or “cookies”. Several browsers and extensions can send GPC for you. Blocking storage does not break this website; the theme and feedback answers simply are not remembered.
Changes and version history
When we change what is stored, or the purposes, we update this page and its version. The consent manager then asks everyone again. Material changes affecting Tractrix Cloud account holders are also announced by e-mail.
| Version | Change |
|---|---|
| 2026-09-30 | First version. Consent manager introduced; “Was this page helpful?” answers now stored only with Preferences consent; GPC and Do Not Track honoured; the website language choice (tx-lang) added before publication, with the website translations. |