The short version
This website sets two cookies on a normal visit, and a third the moment you use a form — all first-party, set by us, readable only by us. The two are random numbers that let our own visitor counter tell a new visit from a returning one, and group the pages you read into a single visit. The third is an essential session cookie that keeps our forms secure and, once you sign in, keeps you signed in; it is created the first time you land on a page with a form on it, such as the contact or sign-up page. None of them holds your name, your email, or anything else personal. The table below has four more. One is set only when you arrive through a link a member of our team shared with you: it holds that team member’s short code, so that if you start a free trial they are credited for it. The other three are only ever set in the browsers of our own administrators and team members.
There is no Google Analytics here, no Meta pixel, no advertising or retargeting tags, and no third-party trackers of any kind. Our analytics are software we wrote, running on our own server, writing to our own database. No analytics company or advertiser gets a copy.
Everything below is detail on those two paragraphs.
Read this first
This is a plain-English policy we publish for transparency. It describes what the site actually does today, checked against the code rather than a template.
It is not legal advice. We reviewed it ourselves against what the site actually sets.
The complete cookie table
Most sites need pagination for this table. Ours has seven rows — two on any visit, one more as soon as you use a form, one only when you follow a link a member of our team shared, two that only our own administrators get, and one only for the Team desk’s pages, which only our team members use — and every one of them is ours.
| Name | Purpose | Type | Duration |
|---|---|---|---|
| PHPSESSID | Form security (CSRF protection), and the signed-in session. Only created when you reach a page that has a form on it — the contact page, the sign-up page, the sign-in page, or the contractor directory’s pages to correct or remove a listing, to claim one and to tell us a business is missing — so reading marketing pages or directory listings never sets it. It ties your browser to the security token our forms carry, so another website cannot submit our form pretending to be you; and once you sign in — at /login/, for the member portal, the agency console or our own admin — the same cookie is what keeps you logged in. It also does this: after you prove a directory listing with a code or an emailed link, it tells our server which listing this browser may attach and which details fill in your trial form (held on our server for this session, never in the cookie). A claim made with a code on the directory’s claim page works for 7 days, and the page gives you a private link to come back to it from any device; that link, not a cookie, carries the claim past this session: its key comes after a # in the address, which your browser leaves out of the address it requests and out of what it passes to other sites; the claim page sends it to us once to restore your claim, and the link then stops working (the page shows a new one). Not used for tracking. Marked HttpOnly, so scripts on the page cannot read it. | First-party, strictly necessary | Expires when you close your browser (or when you sign out) |
| tg_vid | Visitor counting. A random 32-character number — no name, no email, nothing personal in it — that lets our own analytics tell a first-time visit from a returning one. First-party: no other website can read it, and it does not follow you anywhere else on the internet. Marked HttpOnly, SameSite=Lax, and Secure over HTTPS. | First-party, analytics (ours, self-hosted) | 2 years |
| tg_sid | Groups the pages you open into one visit, so reading ten pages in one sitting counts as one visit and not ten. Also a random 32-character number with nothing personal in it. Same flags: HttpOnly, SameSite=Lax, Secure over HTTPS. | First-party, analytics (ours, self-hosted) | 30 minutes, sliding — it resets with each page you open and lapses after 30 minutes of inactivity |
| tg_team | Credits a member of our team who shared a link with you. Only set when you open our site through such a link (an address ending in ?team= and their short code). It holds that code and nothing else: no name, no email, nothing about you. If you start a free trial from this browser while it lasts, our sign-up form reads it and records that team member with your new account, so they are credited (and, under their agreement with us, may be paid a share of what you later pay us). The first such link you follow keeps it: following another team member’s link does not replace it, and following the same link again does not lengthen it. It is the only cookie here that connects a visit to a sign-up, and it does that for this one purpose: it is read only by our own server, never sent to anyone else, and there is no pixel or tag of any kind behind it. Same flags: HttpOnly, SameSite=Lax, Secure over HTTPS. | First-party, referral (ours) | 90 days |
| TGTEAM | Only set when someone opens our Team desk’s pages (/team/), which only our own team members, the people who work with us under contract, have any reason to do, and only while the Team desk is open. No page of this site links to them. It is the Team desk’s own signed-in session, separate from every other: your browser sends it only to the Team desk’s pages (/team/). It ties the browser to the security token the desk’s forms carry, and keeps the team member signed in after their password and a two-step code. Marked HttpOnly and SameSite=Lax, and Secure over HTTPS. | First-party, strictly necessary (the Team desk’s pages only) | Expires when the browser closes; the sign-in itself ends after 60 minutes without use, or 12 hours |
| tg_admin | Only ever set in one of our own administrators’ browsers, when one of us signs in to the admin console. It carries no data beyond a flag, and its only job is to keep our own clicking out of the visitor numbers, so the reports describe real visitors rather than us. If you are not an administrator of this site you will never be given it. Same flags: HttpOnly, SameSite=Lax, Secure over HTTPS. | First-party, internal (administrators only) | Cleared when that administrator switches the exclusion off |
| tg_cdir_preview | Only ever set in one of our own administrators’ browsers, when one of us presses Preview in the admin console. It holds a random pass, which our server checks against a one-way copy of it, and its only job is to show that browser the contractor directory’s pages before they are public, marked so that search engines leave them alone. It is sent only to the directory’s pages, and nobody else is ever given it. Same flags: HttpOnly, SameSite=Lax, Secure. | First-party, internal (administrators only) | 12 hours, and it stops working sooner if an administrator ends all previews |
How the session cookie works, in plain terms: when you open a page with a form, we hand your browser a short-lived ticket. When the form comes back, we check that it carries the ticket we issued. The cookie is how your browser holds the ticket. That, and holding a directory claim you started until you sign in, is its whole job — it stores no personal information and follows you nowhere.
How the two analytics cookies work: the first time you arrive we generate a random number and hand it to your browser as tg_vid, plus a second random number as tg_sid. They are labels, not profiles. When you come back, our counter sees the same random number and adds one to “returning” instead of “new”. It cannot tell us who you are, and no other site can read either number.
How the team link cookie works: a member of our team who talks to you about Tailgate Office may give you their own link, our address with ?team= and their short code. When you open it, we hand your browser that code as tg_team. If you start a free trial from this browser within 90 days, our sign-up form reads the code and records that team member with your new account. That is all it does: the visitor counter does not keep the code, and nothing about your visit goes to the team member. Block it, or clear it, and the site works exactly the same; the team member is just not credited.
Not a cookie, but kept in your browser: the contractor directory’s Save button keeps a visitor’s own shortlist of businesses in this browser’s local storage (not a cookie): it is kept in your browser only, never sent to us, and goes when you remove it or clear this site’s data.
What the analytics actually record: for each page you open we store, in our own database on our own server — the date and time, the page path and title, the site that sent you (just the host, like “google.com”; on a 404 page we keep the full referring URL, because that is the only way to find the broken link and fix it), a traffic-source label, your device type, browser family and operating system family, whether the page returned 200 or 404, and — when the link you clicked carried marketing tags — those tags, meaning utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, fbclid, msclkid, ref and plan. Nothing else from the address bar is kept, because a query string can carry a token or an email address. The raw User-Agent string is not stored. Bot and crawler traffic is filtered out and never recorded, and signed-in administrators are excluded by default.
Your IP address: it is stored only temporarily and deleted as soon as the location lookup completes. That lookup is off by default — when it is off the record is marked done immediately, the address is discarded with it, and no analytics data is sent to any lookup service. If an administrator switches it on, the IP is sent to the configured lookup service (ip-api.com, ipinfo.io or ipapi.co) purely to translate it into a place name, each unique IP at most once and the answer cached. What we keep in that case is a country, a state or region and a city. Never a street address, never precise coordinates.
How long we keep it: pageview records are deleted automatically after a configurable period, 730 days (two years) by default. We do not sell, rent or share this data, and it is never linked to a form submission or a customer record. The full description is in the privacy policy.
Why there is still no cookie consent banner
Consent banners exist mostly because of the third-party half of this — ad networks, pixels and tag managers following you from site to site. We carry none of that. There is no audience being built, no data being sold, and nobody on the other end to sell it to.
We are not going to pretend the two analytics cookies are strictly necessary, because they are not. They are first-party, they hold nothing but a random number, no advertiser or analytics company gets them, and they exist so we can count visits without handing our visitors to Google. We would rather tell you exactly what we set — the table above — than train you to click through a pop-up you did not read.
The team link cookie is not strictly necessary either. It is set only when you choose to follow a link a member of our team gave you, it holds only their code, no advertiser or analytics company gets it, and its one use is to credit them if you start a trial.
If you would rather not be counted, block cookies for this site in your browser. The next section says precisely what changes when you do.
What happens if you block them
You are free to block cookies in your browser settings, including ours. Every page on this site will still read fine — nothing here is gated.
The one thing that breaks: the forms stop working. Without the session cookie, your submission cannot carry a valid security token, so it fails the CSRF check and we never receive it. That is the protection doing its job, not the site being difficult.
Blocking the two analytics cookies is straightforward, and we will be straight about what it does. It does not erase the pageview record itself — that line is written by our server, not by the cookie. What it does is leave us unable to link one visit to the next, so every page you read looks like a brand-new visitor arriving.
If you have cookies blocked and still want to reach us, skip the form entirely: email support@tailgateoffice.com, which works with no cookies at all.
With the cookies blocked
What is not here
Worth stating outright, because on most sites this list is the whole policy.
No Google Analytics
No GA, no session recording, no heat maps, no scroll or mouse tracking. Counting visits is a thing we do ourselves, on our own server, in our own database — and it is the only analytics on this site.
No advertising cookies
No ad pixels, no Meta pixel, no retargeting, no conversion trackers. Reading our pricing page will not follow you around the internet for a month.
No cross-site tracking
No social widgets, no tag managers, no embedded scripts phoning home. Every cookie in the table above is first-party and unreadable by any other website. The only outside request your browser makes from our pages is the Poppins font from Google Fonts — that is a font file, not a cookie, and it is disclosed in the privacy policy.
Our promise on changes, and what it looked like in practice: the earlier version of this page said that if we ever added analytics, the table would grow a row and the date at the top would move. On August 9, 2026 we added our own self-hosted visitor counting, so the table grew three rows — the two random IDs, plus the administrator-only one that keeps our own clicking out of the numbers — the date moved, and this paragraph got rewritten to say so. On October 2, 2026 the session cookie’s row gained the directory claim it can hold on our server until you sign in, and on October 5, 2026 the private link the claim page gives you to come back to that claim from any device, which works without a longer-lived cookie; both times it is the same cookie, and no cookie was added. The same day this page gained the paragraph on the directory’s Save button, whose shortlist stays in your browser’s local storage and is not a cookie. On October 6, 2026, after our own review of the directory’s legal risks, the session cookie’s row named the directory pages with forms, which start it too, and the table gained a row for tg_cdir_preview, a cookie only our administrators get, which had been left out of it; and the note at the top stopped saying a lawyer would review this page. On October 9, 2026 our phone number came off this page, as it came off every page of this site: with cookies blocked, email still reaches us, and questions go to email or the contact form; no cookie changed. On October 31, 2026 the table grew two rows: tg_team, which a link shared by a member of our team sets for 90 days so that they are credited if you start a trial, and TGTEAM, the sign-in cookie of our Team desk, set only on its own pages, which only our team members use; the short version and the section on the banner say so too. On November 1, 2026 this page stopped saying that nobody else gets a copy of our analytics, and that no analytics data ever leaves our server while the location lookup is off: the nightly copies of our database backups, which hold the analytics records too, are stored for us by rsync.net, an offsite backup company our privacy policy names, which does not look inside them. This page also stopped saying that the two analytics cookies never leave our server, since the random numbers they hold are kept in those analytics records. What those lines meant still holds: no analytics company or advertiser gets a copy, and while the lookup is off no analytics data is sent to any lookup service. The same day it stopped saying that the team link cookie never leaves our server: the code it holds is kept with a sign-up in our own records, and so in those backups too; no advertiser or analytics company gets it. No cookie changed. The promise still stands for whatever comes next — and if we ever add something that tracks you across other websites, it will arrive with a consent prompt attached rather than quietly, behind a page like this one.
Questions
Tailgate Office is operated by Tailgate Office, LLC. If anything on this page is unclear, or you think the site is setting something the table above does not list, we want to hear about it: support@tailgateoffice.com or the contact form.
For what happens to the information you type into the form — rather than the cookie that protects it — see the privacy policy. For how our texting products handle consent when they run for customers, see the compliance page.
No trackers to dodge. Just a form that works.
Two first-party cookies on a normal visit, no Google Analytics and no ad tech. The trial is 30 days, no credit card, and nothing on this page follows you to the next website.