Defaults.Exposed › Cookie Notice

Cookie Notice

This page explains, in plain language, which cookies Defaults Exposed uses and why. The short version: we set a few first-party cookies of our own, we use Google Analytics to see how the site is used, and we load two advertising pixels, from Meta and Reddit, that measure our ad campaigns. These tools load when a page opens. We do not show a consent banner and we do not ask before they load. You can switch Google Analytics and the advertising pixels off for your browser at defaults.exposed/optout.

What a cookie is

A cookie is a tiny file a website can store in your browser. Some cookies are needed for a site to work. Others are used for analytics, or by advertising companies to measure ads and decide who sees them. This site uses all three kinds, as listed below.

Analytics

We use Google Analytics 4 to see how the site is used: which pages are viewed, where visitors come from, and which scans and reports are run. It sets the _ga and _ga_* cookies.

We also set our own visitor id, de_vid, a random id for your browser that lasts 400 days. It is sent to Google Analytics with each event and stored with the scans and requests you make here, so we can link visits from the same browser. If you give us your email address, we also set de_uid, which holds a SHA-256 hash of the address (never the address itself) for 400 days. It is sent to Google Analytics as a user id so we can link your visits across devices.

Advertising pixels

Most pages load two advertising measurement tools run by third parties:

• Meta Pixel, from Meta Platforms. It reports each page view to Meta and sets the _fbp cookie, which identifies your browser to Meta. If you arrive from a Meta ad, it also sets _fbc, which holds the ad click id.
• Reddit Pixel, from Reddit. It reports each page visit to Reddit and sets the _rdt_uuid cookie, which identifies your browser to Reddit.

We use them to measure and attribute our ad campaigns: which ads bring visitors, and what those visitors go on to do. The platforms can also use these page views to build audiences for our ads, for example to show a Reddit ad to people who have visited this site.

Our server also reports some actions directly to Meta and Reddit: a completed scan, a view of the pricing page, the start of a checkout, a Fix Guide request (Meta only) and a completed purchase. These reports can include your IP address, your browser’s user agent, the _fbp and _fbc values, the ad click id, and a SHA-256 hash of your email address if you have given it to us. Meta receives the IP address as is, and Reddit receives it hashed. Reddit only receives these reports when you arrived from a Reddit ad.

Meta and Reddit are third parties and process this data under their own terms and privacy policies: the Meta Privacy Policy and the Reddit Privacy Policy.

Our own cookies

Some of our cookies are strictly necessary: the kind a site needs to function properly. For example:

• Security and basic operation. A cookie may be needed to keep the site working correctly and securely while you use it, such as during the one-time check that confirms you own a domain.
• Your preferences. A small cookie may remember a simple choice you’ve made, such as your language.

We also set these first-party cookies:

• de_vid and de_uid, the visitor id and email hash described under Analytics.
• de_attr records where you first arrived from: the campaign tags in the link, the referring site, and any Reddit or Google ad click id. It lasts 90 days and is never overwritten.
• de_src records the type of channel your first visit came from. It lasts 90 days.
• de_notrack records that you have opted out. It lasts one year.

How to opt out

Visit defaults.exposed/optout. Opening that page sets the de_notrack cookie in your browser. While it is present, the Meta Pixel and the Reddit Pixel do not load, Google Analytics sends no data, and our server sends Meta and Reddit no reports of your scans, pricing page views, checkouts or Fix Guide requests. The page has a button to undo this, or you can visit /optout?on.

The opt-out has limits:

• it only covers the browser you set it in, and clearing your cookies removes it;
• de_vid, de_attr and de_src are still set;
• if you buy something, our server still reports the purchase to Meta, and to Reddit if you arrived from a Reddit ad; and
• with JavaScript turned off, a small Meta Pixel image still loads on most pages and reports a page view.

You can also limit ads on each platform directly, in Meta’s ad preferences and Reddit’s privacy settings. Browser tracking protection and content blockers stop the pixels from loading.

How to control cookies in your browser

You’re always in control. Every major browser lets you see the cookies a site has stored, delete them, and block or limit them. Look in your browser’s Settings, under a section usually called Privacy or Cookies and site data. From there you can:

• view and delete existing cookies,
• block cookies from specific sites, and
• choose to be warned before any cookie is set.

Blocking cookies won’t break the main parts of the site. If you block strictly-necessary cookies, some functions, such as confirming you own a domain, may not work as expected.

Where your data is processed

Our own servers are in the European Union, and every request to the site passes through Cloudflare’s global network on the way to them. Google, Meta and Reddit handle the data they receive on their own systems, which include servers in the United States. The Privacy Policy lists every recipient.

Changes to this notice

If we change how we use cookies, we’ll update this page. Significant changes will be made clear.

Contact

Any questions about cookies or your privacy? Email privacy@defaults.exposed.