The short version
This website sets two cookies on a normal visit, and a third the moment you use a form — all first-party, set by us, readable only by us. The two are random numbers that let our own visitor counter tell a new visit from a returning one, and group the pages you read into a single visit. The third is an essential session cookie that keeps our forms secure and, once you sign in, keeps you signed in; it is created the first time you land on a page with a form on it, such as the contact or sign-up page. None of them holds your name, your email, or anything else personal. There is a fourth in the table below, but it is only ever set in one of our own administrators’ browsers.
There is no Google Analytics here, no Meta pixel, no advertising or retargeting tags, and no third-party trackers of any kind. Our analytics are software we wrote, running on our own server, writing to our own database. Nobody else gets a copy.
Everything below is detail on those two paragraphs.
Read this first
This is a plain-English policy we publish for transparency. It describes what the site actually does today, checked against the code rather than a template.
It is not legal advice, and it should be reviewed by the company’s attorney before public launch.
The complete cookie table
Most sites need pagination for this table. Ours has four rows — two on any visit, one more as soon as you use a form, and one that only our own administrators get — and every one of them is ours.
| Name | Purpose | Type | Duration |
|---|---|---|---|
| PHPSESSID | Form security (CSRF protection), and the signed-in session. Only created when you reach a page that has a form on it — the contact page, the sign-up page or the sign-in page — so reading marketing pages never sets it. It ties your browser to the security token our forms carry, so another website cannot submit our form pretending to be you; and once you sign in — at /login/, for the member portal, the agency console or our own admin — the same cookie is what keeps you logged in. Not used for tracking. Marked HttpOnly, so scripts on the page cannot read it. | First-party, strictly necessary | Expires when you close your browser (or when you sign out) |
| tg_vid | Visitor counting. A random 32-character number — no name, no email, nothing personal in it — that lets our own analytics tell a first-time visit from a returning one. First-party: no other website can read it, and it does not follow you anywhere else on the internet. Marked HttpOnly, SameSite=Lax, and Secure over HTTPS. | First-party, analytics (ours, self-hosted) | 2 years |
| tg_sid | Groups the pages you open into one visit, so reading ten pages in one sitting counts as one visit and not ten. Also a random 32-character number with nothing personal in it. Same flags: HttpOnly, SameSite=Lax, Secure over HTTPS. | First-party, analytics (ours, self-hosted) | 30 minutes, sliding — it resets with each page you open and lapses after 30 minutes of inactivity |
| tg_admin | Only ever set in one of our own administrators’ browsers, when one of us signs in to the admin console. It carries no data beyond a flag, and its only job is to keep our own clicking out of the visitor numbers, so the reports describe real visitors rather than us. If you are not an administrator of this site you will never be given it. Same flags: HttpOnly, SameSite=Lax, Secure over HTTPS. | First-party, internal (administrators only) | Cleared when that administrator switches the exclusion off |
How the session cookie works, in plain terms: when you open a page with a form, we hand your browser a short-lived ticket. When the form comes back, we check that it carries the ticket we issued. The cookie is how your browser holds the ticket. That is its entire job — it stores no personal information and follows you nowhere.
How the two analytics cookies work: the first time you arrive we generate a random number and hand it to your browser as tg_vid, plus a second random number as tg_sid. They are labels, not profiles. When you come back, our counter sees the same random number and adds one to “returning” instead of “new”. It cannot tell us who you are, and no other site can read either number.
What the analytics actually record: for each page you open we store, in our own database on our own server — the date and time, the page path and title, the site that sent you (just the host, like “google.com”; on a 404 page we keep the full referring URL, because that is the only way to find the broken link and fix it), a traffic-source label, your device type, browser family and operating system family, whether the page returned 200 or 404, and — when the link you clicked carried marketing tags — those tags, meaning utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid, fbclid, msclkid, ref and plan. Nothing else from the address bar is kept, because a query string can carry a token or an email address. The raw User-Agent string is not stored. Bot and crawler traffic is filtered out and never recorded, and signed-in administrators are excluded by default.
Your IP address: it is stored only temporarily and deleted as soon as the location lookup completes. That lookup is off by default — when it is off the record is marked done immediately, the address is discarded with it, and no analytics data ever leaves our server. If an administrator switches it on, the IP is sent to the configured lookup service (ip-api.com, ipinfo.io or ipapi.co) purely to translate it into a place name, each unique IP at most once and the answer cached. What we keep in that case is a country, a state or region and a city. Never a street address, never precise coordinates.
How long we keep it: pageview records are deleted automatically after a configurable period, 730 days (two years) by default. We do not sell, rent or share this data, and it is never linked to a form submission or a customer record. The full description is in the privacy policy.
Why there is still no cookie consent banner
Consent banners exist mostly because of the third-party half of this — ad networks, pixels and tag managers following you from site to site. We carry none of that. There is no audience being built, no data being sold, and nobody on the other end to sell it to.
We are not going to pretend the two analytics cookies are strictly necessary, because they are not. They are first-party, they hold nothing but a random number, they never leave our server, and they exist so we can count visits without handing our visitors to Google. We would rather tell you exactly what we set — the table above — than train you to click through a pop-up you did not read.
If you would rather not be counted, block cookies for this site in your browser. The next section says precisely what changes when you do.
What happens if you block them
You are free to block cookies in your browser settings, including ours. Every page on this site will still read fine — nothing here is gated.
The one thing that breaks: the forms stop working. Without the session cookie, your submission cannot carry a valid security token, so it fails the CSRF check and we never receive it. That is the protection doing its job, not the site being difficult.
Blocking the two analytics cookies is straightforward, and we will be straight about what it does. It does not erase the pageview record itself — that line is written by our server, not by the cookie. What it does is leave us unable to link one visit to the next, so every page you read looks like a brand-new visitor arriving.
If you have cookies blocked and still want to reach us, skip the form entirely: support@tailgateoffice.com or (301) 268-1943 work with no cookies at all.
With the cookies blocked
What is not here
Worth stating outright, because on most sites this list is the whole policy.
No Google Analytics
No GA, no session recording, no heat maps, no scroll or mouse tracking. Counting visits is a thing we do ourselves, on our own server, in our own database — and it is the only analytics on this site.
No advertising cookies
No ad pixels, no Meta pixel, no retargeting, no conversion trackers. Reading our pricing page will not follow you around the internet for a month.
No cross-site tracking
No social widgets, no tag managers, no embedded scripts phoning home. Every cookie in the table above is first-party and unreadable by any other website. The only outside request your browser makes from our pages is the Poppins font from Google Fonts — that is a font file, not a cookie, and it is disclosed in the privacy policy.
Our promise on changes, and what it looked like in practice: the earlier version of this page said that if we ever added analytics, the table would grow a row and the date at the top would move. On August 9, 2026 we added our own self-hosted visitor counting, so the table grew three rows — the two random IDs, plus the administrator-only one that keeps our own clicking out of the numbers — the date moved, and this paragraph got rewritten to say so. The promise still stands for whatever comes next — and if we ever add something that tracks you across other websites, it will arrive with a consent prompt attached rather than quietly, behind a page like this one.
Questions
Tailgate Office is operated by Tailgate Office, LLC. If anything on this page is unclear, or you think the site is setting something the table above does not list, we want to hear about it: support@tailgateoffice.com or (301) 268-1943.
For what happens to the information you type into the form — rather than the cookie that protects it — see the privacy policy. For how our texting products handle consent when they run for customers, see the compliance page.
No trackers to dodge. Just a form that works.
Two first-party cookies on a normal visit, no Google Analytics and no ad tech. The trial is 30 days, no credit card, and nothing on this page follows you to the next website.