English
This policy explains the cookies and browser storage currently used on the Growth Lab FJL website. Growth Lab FJL is a project and trade name used by Francisco José Luluaga Garcia; it is not a separate legal entity.
Current cookie and storage inventory
cc_cookie: a necessary, first-party cookie created by the self-hosted CookieConsent v3 interface. It records consent categories and services, policy revision, interface language, consent timestamps, expiry metadata, and a locally generated consent identifier. It lasts approximately 182 days, uses SameSite=Lax, and is marked Secure on HTTPS. Eligible same-origin HTTP requests may include the cookie automatically under normal browser cookie rules. Application code does not extract its identifier for analytics or send it to PostHog, GA4, GTM, Brevo Tracker, or another analytics provider.
Persistent attribution is disabled: the site no longer creates, updates, or reads _tk_* session-storage values. On initialization it removes known legacy _tk_* keys without reading or reusing their contents. No replacement cookie, local-storage value, fingerprint, server-side identity, or event history is created.
CookieConsent does not use local storage. The site has no analytics event queue, replay buffer, stable visitor identity, consent logging endpoint, or application-owned analytics endpoint.
Choices and withdrawal
The interface lets you accept all, reject all, or manage categories. Necessary storage is always enabled because it remembers your cookie choice and operates the consent controls. Statistics is optional and disabled before a valid choice.
You can reopen the preferences interface at any time through the permanent Cookie settings / Preferencias de cookies control on every page, change the statistics category, or clear the cookie through browser settings. Withdrawal takes effect immediately in the site consent state.
Accepting statistics currently activates no provider. There is no new delivery to PostHog, Google Analytics 4, Google Tag Manager, Brevo Tracker, or any other analytics destination. Form-processing consent never grants analytics consent.
Deferred persistent attribution
Cross-page attribution remains disabled. Any future implementation requires a separately approved decision covering:
- a defined and documented purpose;
- its ePrivacy and Spanish LSSI classification;
- an applicable GDPR legal basis;
- data minimization and closed value rules;
- an explicit retention period;
- consent behavior where required;
- updated English and Spanish policies;
- a consent revision increment and reconsent where applicable; and
- browser, network, and storage QA.
Deferred analytics governance
Any future PostHog, GA4, or other analytics activation requires a separate reviewed release that:
- loads the provider only after valid statistics consent;
- stops delivery and clears applicable provider persistence on withdrawal;
- uses only reviewed events and event-specific property allowlists;
- keeps session replay, autocapture, heatmaps, console capture, and automatic form capture disabled by default;
- excludes names, email addresses, form values, query strings, and URL fragments;
- separates production from non-production environments;
- defines and publishes an explicit retention period;
- updates the English and Spanish policies and the cookie/tracker inventory;
- increments the consent revision and requests a fresh choice; and
- passes browser and network QA proving no delivery before consent or after withdrawal.
These are future activation conditions, not functionality included in the current release.
Changes and contact
Material changes to purposes, categories, providers, or retention will update this policy and may require a fresh consent choice. Privacy questions can be sent to privacy@growthlab-fjl.com. See the Privacy Policy for more information.