Cookie Policy

The sections that follow describe the technologies and domain patterns configured for site functionality, measurement and advertising. A permitted domain does not prove data collection, and this list does not include every hosting, forms, or security service.

HubSpot’s tracking code runs on every visit as part of how this site works. It records the pages you visit and, as measured on 9 October 2026, each link you click, with its text and address. HubSpot sets its cookies on engagexp.gg, so the browser also sends them to EngageXP’s other addresses under that domain, events.engagexp.gg included; what that server-side endpoint does with them has not been verified.

Always on: no cookie preference controls it, and refusing every optional category does not turn it off. It loads only on website.engagexp.gg.

Google Tag Manager delivers tags according to tracking preferences.

Loads with the default signals; stays off when every optional category is refused.

Help us understand how the site is used, so we can improve it.

Controlled by the analytics preference. PostHog may start before a choice; Google Analytics also depends on the tag manager loading.

Used to deliver advertising that is more relevant to you.

Controlled by the marketing preference and the tag manager loading.

No content-personalization use case is active. This category controls the ad personalization and personalization storage signals.

Controlled by the personalization preference; no separate provider is listed exclusively for this category.

None

The domain patterns configured for the providers above, by provider: what this site permits each one to load from, not a record of requests. A wildcard stands for any subdomain of that host.

• HubSpotjs.hs-scripts.comjs.hs-analytics.netjs.hs-banner.com
  page views, as image requeststrack.hubspot.com
• Google Tag Managerserver-side, on our own domainon load, one empty ad-blocker check to analytics.google.com; no measurement id, no eventcdn.engagexp.ggevents.engagexp.gg
• Google Tag Managerwww.googletagmanager.com
• Google Analytics 4www.google-analytics.com*.google-analytics.comanalytics.google.comwww.google.com
• PostHogsame-origin proxyNone
• Google Adsconversion pings to googleads.g.doubleclick.net and ad.doubleclick.net under the wildcard, and to www.google.com, listed under Google Analytics 4; writes _gcl_authe remarketing audience also needs the personalization category*.doubleclick.net
• LinkedIn Insightsnap.licdn.compx.ads.linkedin.com
• TikTok Pixelanalytics.tiktok.comanalytics-ipv6.tiktokw.us
• Meta Pixelconnect.facebook.netwww.facebook.com

Browser storage lifetime is separate from how long services retain data.

Preference cookieBrowser cookie

Up to 365 days from creation or renewal. Browser settings may shorten this period.

Preferences in local storageLocal storage

No automatic expiry. The record remains until replaced or cleared by you, the browser, or the site.

Language preference cookieBrowser cookie

NEXT_LOCALE, set when the language you are served differs from the one this cookie holds. It records which language to serve on an address that does not name one, and it is strictly necessary for that: it carries no identifier and feeds no measurement. It is a session cookie: the browser discards it when the session ends.

Consent region cookieBrowser cookie

engage_consent_region, set by the site's server from the country your connection comes from, as the hosting provider reports it. It holds only "strict" or "standard", which decides whether the optional categories wait for your choice, and it is strictly necessary for that: it carries no identifier and feeds no measurement. It is a session cookie: the browser discards it when the session ends.

Measurement cookiesBrowser cookie

Up to 400 days, for the Google Analytics cookies that accepting adds. Measured in a browser on 12 September 2026. As now configured, PostHog does not keep its identifier in a cookie; see the next item.

Measurement cookie set by our serverBrowser cookie

Up to 730 days, for FPID, which our server-side tag processing at events.engagexp.gg sets on engagexp.gg when this site's Google Analytics tag sends it a request, and not when the request says analytics is refused. Scripts on the page cannot read it. Measured on 12 October 2026.

Advertising cookiesBrowser cookie

Up to 90 days, for the Google Ads cookie _gcl_au and, when you arrive through a Google ad link (gclid or dclid), _gcl_aw or _gcl_dc, and the Meta Pixel cookies _fbp and, when you arrive through a Meta ad link (fbclid), _fbc. The marketing category writes them before you choose; refusing it stops the tags, and a cookie already written stays until it expires or you clear it. Measured in a browser on 4 October 2026; 90 days is also what Google and Meta publish for them (read 4 October 2026; _gcl_aw and _gcl_dc, which were not measured, read 12 October 2026).

PostHog visit identifierSession storage

Kept as ph_phc_…_posthog in the browser tab’s session storage, not in a cookie, and cleared by the browser when that tab’s session ends. PostHog may write it before you choose, because analytics runs until you turn it off; refusing analytics removes it. PostHog also keeps engagexp_posthog_consent in local storage, with no automatic expiry; it records only whether PostHog measurement is on or off in this browser. Read from the PostHog library’s code on 14 September 2026; not yet measured in a browser.

Data held by measurement and advertising servicesProvider retention

Retention periods depend on the service and its configuration. Google Analytics: not verified; the controller declined the read-only analytics scope, so the period is published as unverified. Sentry: 30 or 90 days for error events depending on the plan, per the retention table Sentry publishes (read 24 September 2026). LinkedIn Insight Tag: LinkedIn removes direct identifiers within seven days and deletes the remaining pseudonymous data within 180 days, per its Insight Tag help page (read 25 September 2026). TikTok pixel: not verified, because TikTok publishes no retention period for pixel data. Meta Pixel: Meta Platforms, Inc. may keep the event data for a maximum of two years, and any audience built from it until the advertiser deletes it, per the Meta Business Tools Terms (read 4 October 2026). Google Ads: not verified at the account; Google states that it anonymises advertising data in its server logs by removing part of the IP address after 9 months and cookie information after 18 months, per its data retention page (read 4 October 2026). To request information about processing and retention, write to privacy@engagexp.gg.

Data held by PostHogProvider retention

When read on 13 September 2026, the PostHog project that receives this site’s data reported an event retention period of 84 months. That period was not being enforced, so PostHog was not deleting events by age. To request information about processing and retention, write to privacy@engagexp.gg.

HubSpot cookie __hstcBrowser cookie

Six months, per HubSpot’s cookie documentation (measured on 9 October 2026: 180 days), on engagexp.gg. HubSpot’s main visitor-tracking cookie: it holds the domain, the HubSpot visitor id, the times of the first, last and current visit, and the session number.

HubSpot cookie hubspotutkBrowser cookie

Six months, per HubSpot’s cookie documentation (measured on 9 October 2026: 180 days), on engagexp.gg. The HubSpot visitor id, an opaque value HubSpot uses to tell browsers apart and, when a form is submitted, to deduplicate contacts.

HubSpot cookie __hsscBrowser cookie

30 minutes, on engagexp.gg. Keeps track of the session: HubSpot uses it to decide whether to count a new session in __hstc.

HubSpot cookie __hssrcBrowser cookie

Until the browser session ends, on engagexp.gg. HubSpot sets it whenever it changes the session cookie, to tell whether the browser has been restarted.

Cookie __cf_bm on HubSpot’s script domainsBrowser cookie

30 minutes, on hs-scripts.com, hs-analytics.net and HubSpot’s other script domains, not on this site’s domain. Set by HubSpot’s CDN provider when the browser downloads the tracking code; HubSpot’s cookie documentation lists it as a necessary cookie for bot protection.

Data held by HubSpotProvider retention

HubSpot does not publish how long it keeps the page views and clicks its tracking code records: its cookie and tracking help pages, read on 9 October 2026, give cookie lifetimes only. HubSpot deletes inactive contacts automatically only where an account turns on its data retention policy, which is off by default; whether it is on in EngageXP’s account has not been verified. To request information or deletion, write to privacy@engagexp.gg.