Cookies on TOVIO sites

This article covers the public marketing and documentation sites. The authenticated app is a separate origin with a separate answer, at the end.

Those two sites load three measurement components and nothing else:

• Cookie-free edge analytics, which sets no cookie and needs no consent.
• Google Analytics 4, which sets first-party cookies and does need consent.
• A browser-monitoring agent for errors and performance. It sets no cookie — its identifier is kept in your browser's local storage — but it is an identifier, so it is gated exactly like Google Analytics on these two sites: nothing reaches it before a decision exists. Session replay and session tracing are switched off.

There is no advertising technology, no ad personalization, no advertising cookie, and no other third-party analytics on those sites.

Which regime applies to you depends on where you are

The country the network edge reports for your connection decides this. If it cannot be determined — an unknown-country answer, a failed lookup, a blocked request, a host that is not behind the edge — the stricter regime applies and you are asked.

European Economic Area, United Kingdom, Switzerland

Google Analytics is off until you accept. No request reaches Google and no analytics cookie exists unless you accept in the banner on your first visit. Rejecting is one click, the same size and in the same place as accepting, and nothing on either site changes when you reject.

Everywhere else

Google Analytics is on by default and a notice on your first visit says so. One click in that notice turns it off, or use the button on the cookie policy at any time; turning it off stops further measurement and deletes the Google Analytics cookies already set. Be aware of the exact scope: withdrawal records a refusal that stops the monitoring agent capturing, but it does not erase the identifier that agent has already stored in your browser. Clearing site data for the origin does that.

This is worth being blunt about: outside Europe the default is on, not off. An article that told you the sites always default to the privacy-preserving option would be wrong.

Global Privacy Control is honoured everywhere

If your browser sends a GPC signal it is treated as a refusal under both regimes, and no banner or notice is shown at all. An explicit acceptance you make yourself still takes precedence over it, because a specific informed choice outranks a default.

The cookie that records your choice

A first-party tovio_consent cookie stores it for 180 days, shared across the marketing and documentation sites so you are asked once rather than twice. It holds granted or denied when you chose, and implied when analytics was on by default and you did not turn it off — an unmade choice is deliberately not written down as though you had made one.

What is not there

No third-party fonts, no external CDNs, no vendor chat or feedback widgets, no ad tech. That is enforced by a content security policy that is a closed allowlist: the measurement origins listed above are named explicitly and every other origin is refused, including for fonts, images, and network calls. It is pinned in the deployed header configuration, asserted in unit tests, and re-checked against the live sites by a smoke workflow — a mechanism, not an intention.

The allowlist is also the honest limit of the claim. It does not say the sites are free of third-party code; it says the third parties are exactly the ones named on the cookie policy, and that nothing else can be added without changing a checked-in policy that tests would catch.

The portal hosts are a different operator

The feedback and help hosts on tovio.dev are served by a third-party vendor. They are the vendor's application, they set the vendor's cookies under the vendor's own notice, and the banner described on this page does not control them. TOVIO-owned pages load none of the vendor's code and set none of its cookies; the only connection between the two is an ordinary hyperlink.

Two honest consequences of sharing a parent domain: because tovio_consent is scoped to .tovio.dev, your browser also sends its value — granted, denied, or implied, and nothing else — to those hosts, where nothing reads it. And depending on the scope the vendor assigns them, its cookies may be sent back to TOVIO-owned hosts, where TOVIO pages ignore them.

A boundary worth knowing

A session on the portal is never treated as authentication by TOVIO Cloud or the app, even though the portal sits on a tovio.dev subdomain and a cookie scoped to the parent domain would be sent to it. That rule is written down precisely because the domain layout makes the mistake easy.

The authenticated app, which is the least-gated surface

The app is a separate origin and is not governed by the banner described above. For storage it uses strictly necessary session, security, anti-replay, and preference storage, and it does not place authentication secrets into the marketing origin.

The part worth saying plainly: the app has no consent banner, so where a build enables browser monitoring there, it loads without a consent gate. That is a deliberate, recorded decision rather than an oversight, and it makes the authenticated dashboard the one TOVIO surface where measurement is not gated on a choice. Two limits on it: session replay and session tracing are off there as well, so no recording of your dashboard is captured, and URLs are reduced to origin and path before they are sent, so query strings and fragments — which on that surface carry sign-in codes and private repository names — are dropped rather than transmitted.

An article that spent five sections on where the default is off would be misleading if it left this one out.

Full detail

The cookie policy on the marketing site is the record, and it is still a draft awaiting legal review. Where it and this article differ, it wins.