Cookie and Browser Storage Policy

Version: 1.0

Effective date: September 7, 2026

Operator: Omar Aguilar, an individual offering services under the TGM Services name

Contact: the support page on this website, at /support

1. Purpose

This Policy explains how TGM Services uses cookies, local browser storage, temporary memory, and similar technologies on the website. It should be read with the Privacy Policy.

2. What These Technologies Are

• A cookie is a small value a website or provider stores in your browser and receives with later requests.
• Local or session storage lets a website remember information in your browser without sending it automatically with every request.
• Temporary memory can connect actions during an open page/tab session and disappears when the page context resets.
• A third-party provider may use its own cookies/storage when you sign in, pay, or use a provider-controlled page.

3. TGM's Current Analytics Baseline

TGM's first-party analytics is designed to be cookieless:

• it does not assign a persistent analytics cookie;
• it does not build a cross-site advertising profile;
• a temporary memory-only visit identifier can connect page and funnel events during the current visit; and
• that temporary context may reset on refresh, tab closure, or departure.

This means TGM accepts less reliable returning-visitor attribution in exchange for a simpler and more privacy-conscious launch baseline.

4. Strictly Necessary And Functional Storage

Depending on the feature you use, TGM may use browser storage for:

• signed-in account sessions and authentication security;
• OAuth sign-in/linking state for Discord or Google;
• CSRF, abuse-prevention, and request-integrity controls;
• cart contents and selected service configuration;
• short-lived user-interface preferences;
• checkout continuity and payment return state; and
• passkey or device-authentication ceremonies.

These functions are needed to provide a feature you requested or protect the website. Blocking them can prevent sign-in, cart, checkout, account, Vault, or security functions from working.

Every cookie TGM sets

All of these are first-party — set by this website, not by anyone else — and all of them are necessary for a function you asked for.

• authjs.session-token — keeps you signed in, so every page does not ask again. Lasts up to 30 days if you chose to be remembered, otherwise until the browser closes.
• authjs.csrf-token — proves a form was submitted from this site, which is what stops another site posting to it as you. Lasts the browsing session.
• authjs.callback-url — remembers the page you were on so signing in returns you to it. Lasts the browsing session.
• authjs.pkce.code_verifier and authjs.state — used for a moment during a Google or Discord sign-in, to check the reply came back from the same request that started it. A few minutes, during sign-in only.
• tgm.stepup.binding — records that this particular browser has completed a passkey check, so an administrator is not asked for it repeatedly. Lasts 30 days, or until you sign out, and is cleared when you sign out.

Everything TGM keeps in local storage

Local storage stays on your device until it is cleared. It is never sent automatically with a request.

• tgm.cart.v2 — your basket, so it survives a refresh. Kept until you clear it or complete the order.
• tgm.cart.v1 — the previous basket format, read once and migrated.
• tgm.editMode — remembers whether an administrator left the on-page editing tools switched on. Never set for a customer. Kept until switched off.

Everything TGM keeps in session storage

Session storage is erased when you close the browser tab.

• tgm.assistant.transcript — the last forty messages of your conversation with the on-site assistant, so closing the panel does not lose it. It is what you typed and what the assistant answered.
• tgm.assistant.conversation — the identifier of that conversation, so replies attach to it.
• tgm.assistant.open — whether the assistant panel was open.
• tgm.assistant.greeting — the greeting the assistant showed you, so reopening the panel does not repeat it.
• tgm.assistant.greeting.previous — the greeting before that, so the next one is guaranteed to be different.
• tgm.assistant.greeting.rotation — how many greetings you have been shown, so they cycle.
• tgm:stripe-redirect — a marker set just before you are sent to Stripe, so returning to the site knows a payment was in progress.

There is nothing else. TGM sets no advertising identifier, no analytics identifier, and no cross-site profile, which is why there is no non-essential category on this page to turn off.

5. Payment And Sign-In Providers

When you use Stripe Checkout, Discord sign-in/linking, Google sign-in/linking, or another provider-controlled flow, that provider may set or read its own cookies and similar technologies for authentication, payment processing, security, fraud prevention, preferences, and service operation.

Those technologies are governed by the provider's privacy and cookie notices. TGM configures only the integration it operates and does not control unrelated provider browsing activity.

6. Advertising And Marketing Trackers

TGM does not currently use third-party advertising pixels or cross-site behavioral advertising trackers under the approved launch architecture.

No future nonessential marketing, advertising, replay, or behavioral tracker may be enabled merely by updating this text. Before it loads, TGM must:

1. review the business and privacy need;
2. update the provider/data inventory and Privacy Policy;
3. determine whether prior opt-in consent is required where our customers are;
4. provide the required consent controls before collection; and
5. verify withdrawal and Global Privacy Control behavior.

7. Do Not Track And Global Privacy Control

Browsers may send Do Not Track or Global Privacy Control signals.

TGM treats either signal as a refusal. When your browser sets Do Not Track to 1, or sets Global Privacy Control, TGM stops sending behavioral analytics for that browser entirely — page views, funnel steps, and interaction events are not recorded.

Necessary authentication, security, checkout, payment, and fraud-prevention functions still operate, because they are not analytics and the site cannot do what you asked without them. TGM performs no persistent cross-site advertising tracking under any setting.

8. Your Controls

You can delete or block cookies and local storage through your browser settings. You can also use private-browsing controls and provider account settings.

Removing storage can:

• sign you out;
• clear your cart or selections;
• interrupt an OAuth/payment return;
• require another identity/security check; or
• prevent a requested feature from working.

Because TGM's analytics is cookieless, there is no separate TGM analytics cookie to disable.

9. Consent Banner Decision

TGM does not show a consent banner merely for decoration. Under the current design, first-party analytics is cookieless and browser storage is limited to the necessary or requested functions listed in section 4. There is no non-essential technology on this site to consent to, which is why there is no banner asking you about one.

If that ever stops being true, the banner is a prerequisite for the change, not a follow-up to it.

If nonessential technology is added or a jurisdiction requires prior consent, TGM must implement a real consent choice before the technology loads. Updating this paragraph alone is not sufficient.

10. Changes To This Policy

We may update this Policy when browser storage, providers, or legal requirements change. The website will show the current version and effective date. Material changes will receive the notice described in the Privacy Policy.

11. Contact

Questions about cookies and browser storage:

• TGM Services — Omar Aguilar, an individual offering services under the TGM Services name
• The support page on this website: /support
• Verified Discord: discord.gg/QUxX5xn9Xe

TGM is an online business and does not publish a walk-in or mailing address. The support page is the monitored contact route for this Policy.