Totalum, Inc.
Effective: · Version 2.0 · Binds users registered before that date from
This policy lists every cookie, browser-storage key, tracking pixel and server-side measurement that Totalum, Inc. (“Totalum”, “we”) uses on www.totalum.app (the “website”) and on platform.totalum.app (the “platform”). It is written to match what the code actually does. It does not cover the applications our customers build and publish with Totalum; those are operated by their owners, and we set no cookies and load no analytics on them (see Section 2).
A cookie is a small text file that a website asks your browser to store and to send back on later visits. Browsers also offer localStorage and sessionStorage, which store values on your device without sending them automatically; a pixel is a script or tiny image that a third party loads on a page to record a visit and set its own cookies; a software development kit (SDK) is third-party code embedded in a site; and a server-side conversion API is a channel through which our servers, not your browser, report an event (such as a registration) to an advertising platform.
All of these are treated the same way by the laws that apply to us: Article 5(3) of the EU ePrivacy Directive 2002/58/EC as implemented in Spain by Article 22.2 of Law 34/2002 (LSSI), regulation 6 of the UK Privacy and Electronic Communications Regulations 2003, and, in the United States, the California Consumer Privacy Act and comparable state laws, under which sending identifiers to advertising platforms is “sharing” for cross-context behavioural advertising (and, under some of those laws, a “sale”). When this policy says “cookies”, it means all of these technologies.
First-party cookies and storage are set by our own code on our own domains. On the website the only first-party storage is the localStorage and sessionStorage listed in Section 4; the website itself sets no cookies except the authentication cookie in its administration area. On the platform we set the cookies listed in Section 5, all of which exist to run the product.
Third-party cookies are set by other companies whose tags we load: Google LLC (Google Tag Manager, Google Ads, Google Analytics 4), Meta Platforms, Inc. (Meta Pixel) and Reddit, Inc. (Reddit Pixel). They receive data directly from your browser and use it under their own policies (Section 9).
Published customer apps. The apps our customers publish (at subdomains of totalum-project.com or on their own domains) are theirs. Totalum injects no analytics, no pixel and no cookie into them. The only thing we add, on free-plan sites, is the “Made with Totalum” badge, which is a static link with no tracking. Whether such an app uses cookies is decided by its owner, who must provide its own cookie information and consent mechanism.
Advertising and analytics tags on the website (Section 7) load only when our consent code says they may. The code applies three rules, in this order:
Your decision is stored in your browser's localStorage under the key cookie-consent, together with the date and the version of this policy. An accept or reject is kept for 12 months, and a plain close for 6 months, after which we ask again (in the prior-consent regions only). If we materially change the technologies we use, we increase the policy version and ask again sooner. Withdrawing consent is as easy as giving it: the button at the top of this policy (linked from every footer as “Cookie policy”) re-opens the banner. Because a script that has already run cannot be unloaded, a withdrawal takes effect from the next page you load.
Google Consent Mode v2. Before any Google script loads, the website declares the consent signals ad_storage, ad_user_data, ad_personalization and analytics_storage as denied. They are updated to granted only when the rules above allow the tags to load. functionality_storage and security_storage are always granted, as they concern strictly necessary storage.
On the platform we use the strictly necessary cookies listed in Section 5 and Google Analytics 4 for product analytics (Section 6). There is no advertising pixel on the platform. You can opt out of Google Analytics 4 with Google's browser add-on, by blocking third-party cookies in your browser, or by sending a Global Privacy Control signal, which we treat as an opt-out from analytics as well.
These items are set by our own code and are needed to remember your choices, keep referral rewards honest and attribute a registration to the campaign or referrer that produced it. None of them, by itself, sends anything to a third party. They do not require consent under Article 5(3) of the ePrivacy Directive because they are used only to provide something you have asked for or to operate the site, but you can delete them at any time from your browser's site-data settings.
| Key | Type | Purpose | Duration |
|---|---|---|---|
cookie-consent | localStorage | Records your Accept / Reject / close decision, its date and the policy version. | 12 months (then asked again) |
totalum-lang | localStorage | Remembers whether you chose English or Spanish. | Persistent (until deleted) |
totalum_referral_params | localStorage | Referral code and the source / campaign parameters you arrived with, so a referrer is credited if you register. | 30 days |
totalum_attribution | localStorage | First-touch attribution snapshot: campaign (UTM) parameters, advertising click identifiers present in the URL you arrived on (for example gclid, fbclid, ttclid, rdt_cid), the referring page, the first page visited, the Google Analytics client identifier if the _ga cookie exists, device type, language, time zone, screen width, and visit counts. It is read only by our own code and is attached to your account if you register, to know which channel brought you and to pay referral rewards. It never contacts a third party by itself. | Persistent (until deleted) |
totalum_rdt_conversion_id | sessionStorage | A random identifier used to de-duplicate a Reddit conversion event. Only meaningful when the Reddit Pixel is allowed to load. | Browser session |
better-auth.session_token / __Secure-better-auth.session_token | Cookie (HttpOnly) | Authentication session. Set only in the website's private administration and dashboard areas, not on public pages. | Browser session |
The platform sets the following first-party cookies. Those marked HttpOnly cannot be read by scripts in the page. All of them exist to sign you in, keep your preferences, honour a referral, finish an action you started on the website, or route existing customers to the right place. They do not require consent.
| Cookie | Purpose | Duration |
|---|---|---|
tp_attr | First-touch attribution carried over from the website (the same fields as totalum_attribution) or rebuilt from the URL and referrer, so that a registration can be attributed. HttpOnly. | 90 days |
tp_rdt_cid | Reddit click identifier used to de-duplicate a conversion event. HttpOnly. | 90 days |
tp_ref | Referral code of the person who invited you, written once, so their reward can be paid. HttpOnly. | 90 days |
tp_interest | Which marketing page (API or MCP) you signed up from, to show the matching onboarding. HttpOnly. | 2 hours |
tp_prompt | The idea you typed in the prompt box on the website, so the platform can start your first project with it after you sign in. | 30 minutes |
tp_template | The template you chose to import, to be claimed after sign-up. HttpOnly. | 30 days |
tp_sidebar | Whether you collapsed the sidebar. | 365 days |
tp_locale | Your interface language. | 365 days |
tp_legacy | Remembers that your email belongs to a legacy Totalum account, to route you correctly. | 180 days |
tp_legacy_stay | Suppresses the legacy redirect for a short time after you choose to stay on the platform. | 30 minutes |
tot_legacy | Set by accounts.totalum.app on the .totalum.app domain so the platform recognises a legacy customer. | Persistent |
tp_invite_oauth | Locks a Google sign-in to the email address that received a team invitation, for the duration of the sign-in. | Minutes |
better-auth.session_token / __Secure-better-auth.session_token | Your authenticated session. HttpOnly. | Browser session |
The platform also keeps interface preferences and drafts in localStorage and sessionStorage (for example tp-theme for light or dark mode, and keys prefixed totalum: for the projects view and sort order, sound, database page size, chat panel width, unsent prompt drafts, dismissed notices and a prompt pending for a project). These never leave your device except when you send the draft yourself.
The platform loads Google Analytics 4 (provider: Google LLC, United States) to understand how the product is used, in aggregate. Google may set the following cookies. Google is certified under the EU-US Data Privacy Framework; see Section 9 for its policy and opt-out.
| Cookie | Provider | Purpose | Duration |
|---|---|---|---|
_ga | Google Analytics 4 | Distinguishes visitors with a random client identifier. | 2 years |
_ga_* | Google Analytics 4 | Keeps session state for a given measurement property. | 2 years |
_gid | Google Analytics 4 | Distinguishes visitors for 24 hours. | 24 hours |
Our servers also send a sign_up event to Google Analytics using the client identifier from the _ga cookie when you register, so that registrations can be counted against the campaign that produced them. That is described in Section 8.
The website loads the four tags below only when Section 3 allows it. Each is loaded by a script from the provider's own domain, which then sets the cookies listed and records that you visited a page (and, where a conversion component fires, that you started a registration or completed a purchase). These providers may combine that data with what they know about you from their own services, under their own policies. They are all established in the United States; Google and Meta are certified under the EU-US Data Privacy Framework, and Reddit relies on Standard Contractual Clauses.
| Tag | Identifier | Cookies it may set | What it does | Duration |
|---|---|---|---|---|
| Google Tag Manager | GTM-N2SFZLB3 | _ga, _gid, _gcl_au, _gcl_aw; IDE and test_cookie on doubleclick.net | A container that loads Google Analytics and Google Ads tags configured by us; measures page views and conversions. | Up to 2 years (_ga); 90 days (_gcl_au); 13 months (IDE) |
| Google Ads (gtag.js) | Configured per environment | _gcl_au, _gcl_aw, IDE | Conversion measurement for Google Ads campaigns and remarketing lists. | 90 days (_gcl_au); 13 months (IDE) |
| Meta Pixel | 961656343514570 | _fbp, _fbc | Records PageView on every page and CompleteRegistration / Lead and Purchase events; lets Meta measure and optimise ads and build audiences. | 90 days |
| Reddit Pixel | a2_jcs2e1sr3ri9 | _rdt_uuid, _rdt_cid | Records PageVisit on every page and SignUp events; lets Reddit measure and optimise ads. | 90 days |
Under the California Consumer Privacy Act and similar laws, loading these tags is “sharing” personal information (device and browsing identifiers) for cross-context behavioural advertising. Rejecting them in the banner, using the Do Not Sell or Share link, or sending a Global Privacy Control signal is your opt-out. The Your Privacy Choices section of the Privacy Policy explains the rest of your rights.
When you register or pay, our servers, not your browser, may report that event to the advertising platforms we use so that they can measure which campaigns work: Google Ads offline conversion import, Meta Conversions API and Reddit Conversions API, plus a sign_up event to Google Analytics 4. The data sent consists of a one-way hash (SHA-256) of your email address and, if you gave one, phone number; the advertising click identifiers captured in your browser (gclid, fbclid and the _fbc / _fbp values, rdt_cid and _rdt_uuid); your IP address and browser user agent; and, for a purchase, its value, currency and order number. These platforms use it to match the event to an ad you may have clicked.
This is also “sharing” under US state privacy laws. These server-side events are gated on the same choice as the tags: if you reject advertising cookies or send a Global Privacy Control signal on our website, the click identifiers those events rely on are not captured, the registration is marked as made without advertising consent, and our servers do not send it to Google, Meta or Reddit. Once you have an account you can also switch on “Do not sell or share my personal information” in Settings, which stops these events for your account immediately, or email contacto@totalum.app and we will apply it for you.
Whether these companies are certified under the EU-US Data Privacy Framework can be checked on the official DPF list. Their advertising cookies are also subject to the industry opt-out tools at youradchoices.com (United States) and youronlinechoices.eu (Europe).
Our banner. Use the button above to change your decision at any time.
Global Privacy Control. Turn on GPC in a browser or extension that supports it (see globalprivacycontrol.org); we treat it as an opt-out on both of our sites without you having to do anything else.
Your browser. You can view, delete and block cookies and site data:
Deleting the storage listed in Sections 4 and 5 resets your preferences and referral attribution. Blocking the strictly necessary cookies of the platform prevents you from staying signed in.
The Privacy Policy describes the personal data involved, the recipients, international transfers and your rights, including the Your Privacy Choices section for United States residents.
Some browsers offer a “Do Not Track” (DNT) setting. There is no accepted standard for what a website should do in response, and we do not change our behaviour in response to DNT signals. We do honour the Global Privacy Control signal, as described in Section 3, as a request to opt out of the sale and sharing of personal information and of targeted advertising, and as a rejection of analytics and advertising cookies. This statement is made for the purposes of the Delaware Online Privacy and Protection Act and the California Consumer Privacy Act.
We update this policy when we add, remove or change a technology. The effective date and version are printed at the top. When a change is material (for example a new advertising partner), we increase the consent version in our code, which invalidates stored decisions and shows the banner again so that you can decide afresh. Prior versions are available on request.
Questions about cookies or this policy: contacto@totalum.app. Totalum, Inc., a corporation organized under the laws of the State of Delaware, United States of America. Registered agent: Legalinc Corporate Services Inc., 131 Continental Drive, Suite 305, Newark, DE 19713, New Castle County, United States. Further company details are in the Legal Notice.
Related documents
This document can be printed or saved as a PDF from your browser.
© 2026 Totalum, Inc.