Cookie Policy

There are two kinds of cookie on this site: the ones that make it work, and the ones you have a say over.

Essential cookies are set automatically, because without them the site cannot do what you asked it to — you would not stay signed in. What happens with everything else depends on where you are, as the next section explains. In the EEA, the UK and Switzerland, everything else is set only if you accept it. Elsewhere it is on by default, and you can switch it off. Either way, SmartKDP works exactly the same whatever you choose, and nothing is withheld from you for saying no.

There are two separate things to decide, and you can say yes to one and no to the other:

• Analytics — which pages are useful and where the site confuses people.
• Advertising — whether an ad we paid for, or a partner's affiliate link, led to a purchase.

Where you are decides the default

In the EEA, the UK and Switzerland (and the territories that follow their rules), we ask first. Until you answer the banner, we set nothing at all, and if you decline, the matter is closed.

Everywhere else, there is no banner. Analytics and advertising measurement are on from your first visit, and you can switch either off at any time with Cookie settings (see "Changing your mind" below). If your browser sends a Global Privacy Control signal, we treat it as a request to switch advertising off, including affiliate tracking, and it starts off for you.

How we tell where you are:

• From your connection. Our hosting provider, Cloudflare, works out which country a request comes from, as it does for every website it serves, and that decides which of the two you get. We do not store it for this purpose, and no cookie is set to remember it.
• From your browser's time zone. It is read in your browser and never sent anywhere. If your time zone is in Europe, you get the European treatment even if your connection says otherwise, for example behind a VPN. It can only ever make things stricter.
• If we cannot tell, you get the European treatment.

We never ask your browser for your location, and nothing here involves your precise whereabouts.

Until 21 October 2026, everyone everywhere got the European treatment. We changed it because the laws that require asking first apply in Europe, and treating every visitor in the world as though they did meant we could not tell which of our pages were useful to most of the people reading them. This page says so rather than quietly rewording its promises.

The cookies we set

We have measured the lifetimes above rather than copying them from a vendor page. The analytics figure is 400 days because that is the ceiling browsers now impose on any cookie set by a script; older versions of this page said "up to 2 years", which was the vendor default and not what actually happened on your device.

Cookies set during payment

Payments are taken by Lemon Squeezy, our merchant of record. Its checkout — which opens in an overlay on our page, or on Lemon Squeezy's own domain — sets cookies of its own for fraud prevention and to make the payment work. They are a security control, not advertising, and they belong in the strictly-necessary category. Because that checkout is Lemon Squeezy's rather than ours, the cookies it sets are governed by Lemon Squeezy's privacy policy, and our cookie banner does not control them. If you choose to pay with PayPal inside that checkout, PayPal sets equivalent fraud-prevention cookies of its own, described in PayPal's privacy statement.

Embedded videos

Some pages include a product demo video. It does not load until you press play. Until then the page shows a still image we host ourselves — no request reaches the video host, no cookie is set, and your IP address is not disclosed to anyone.

If you press play, the player loads from cloudflarestream.com, the video service run by Cloudflare, and it may then set storage on your device to support playback. Pressing play is what permits that; not pressing it is a complete refusal, and every page works the same either way.

Until 3 September 2026 the video was hosted on YouTube and this section described that instead. Nothing about the promise changed — the player still loads only when you press play — but the company receiving that request did, so this page says so rather than quietly swapping the name.

Signing in with Google

If you are not signed in, Google's One Tap card may offer to sign you in with your Google account. It is a convenience, not a requirement: the Continue with Google button and ordinary email sign-in both work without it.

In Europe, it waits until you have answered the cookie banner. Any answer will do, including Decline — this is not something we ask your permission for, because it is a sign-in feature rather than a measurement one, and making it conditional on accepting analytics would be bundling two unrelated questions into one. What it does mean is that nothing reaches Google, and no cookie of any kind appears, until you have had your say. Elsewhere there is no banner to wait for, so the card can be offered on your first page view.

Once the card is active, two things happen that are worth stating plainly. Google's sign-in script loads from accounts.google.com, which discloses your IP address to Google. And it sets the g_state cookie in the table above, which is how it avoids showing you the same card on every page.

Until 13 September 2026 that script loaded on your very first page view, before the banner had been answered, and g_state was set at the same moment. We found it while auditing this page against what the site actually does, and we changed the code rather than the promise. It is described here because this page commits to naming every non-essential cookie before it is set, and for a period that cookie was not named at all.

Analytics, and what we ask you for

We use Google Analytics 4 to understand which pages are useful, which features people actually reach, and where the site confuses them. It tells us things like how many people viewed the pricing page and how many went on to sign up.

In Europe, when you first arrive, we ask. Until you answer:

• no analytics cookie is set,
• Google receives no identifier that persists between your visits, and
• nothing is stored on your device for measurement purposes.

This is enforced with Google Consent Mode, which is set to deny analytics storage before the Google script loads — not after it, and not as a request we hope it honours.

If you accept, the cookies in the table above are set and we can recognise a returning visitor. If you decline, we do not.

Elsewhere, analytics is on from your first visit, set the same way before the Google script loads. If you switch it off with Cookie settings, that is recorded on your device and honoured on every visit after, exactly as a refusal in Europe is.

Advertising, and what we ask you for

We advertise SmartKDP on Google. Advertising costs money, so we need to know which ads are worth paying for — specifically, whether a click we paid for ended in a purchase. That is the whole of what the advertising choice covers.

If advertising is on for you — because you accepted it in Europe, or because you are elsewhere and have not switched it off:

• Google Ads sets the _gcl_* cookies above, recording that you arrived from one of our ads.
• When you buy something, we tell Google that a purchase happened, its value, and that it can be credited to that click.
• We also send Google a scrambled form of your email address — a one-way hash, computed in your browser before anything is sent — so Google can match the purchase to the click even if the cookie has been cleared. It is one-way in the sense that the address cannot be read back out of it, but it is not anonymous: anyone who already knows an address can compute the same value. We are telling you because "we never send Google your email address" was true of this site until this change, and it is no longer true while advertising is on.
• If you also arrived through an ad, we keep the click identifier Google put in the link on your device for up to 90 days, so a purchase you make later can still be credited. It is kept in your browser's localStorage, not in a cookie.

If you decline or switch off advertising, or your browser sends Global Privacy Control, none of that happens — no advertising cookie, no click identifier kept, nothing about your purchase sent to Google Ads at all, not even in an anonymous form. We could send an anonymised signal in that case and Google would accept it; we have chosen not to, because at our size it would tell us nothing we could act on and it is not what "no" reasonably means.

What we never do, whatever you choose: we do not sell or share your data, we do not build advertising audiences or remarketing lists, we do not use Google Signals or ad personalisation, and we never send Google your name or anything else that identifies you personally beyond the scrambled address described above. Ad personalisation is switched off in code, permanently, and there is a test that fails if anyone ever switches it on.

Affiliate links

Some people who write about SmartKDP are paid a commission when a reader they sent buys something. Their links carry an ?aff= code. If you arrive through one and advertising is on for you, Lemon Squeezy's affiliate script loads from lmsqueezy.com: it sets the ls_aff_ref cookie above, computes a device identifier from your browser's characteristics so the referral survives a cleared cookie, and sends both to Lemon Squeezy with the page address and the site that referred you. When you pay, the checkout carries the referral so the partner is credited. Your price is the same either way.

If advertising is off for you, or you did not arrive through an affiliate link, the script never loads, nothing is sent, and no partner is credited. Switching advertising off later deletes the cookie.

Until 13 September 2026 this page said we ran no advertising at all, which was true when it was written. It is not true now. We have rewritten the section rather than deleting the sentence, so you can see what changed and when.

Changing your mind

Select Cookie settings at the bottom of the page, or in your account menu when you are signed in. That brings back the same three choices — Decline, Accept all, or Analytics only — and takes effect immediately. In Europe, opening it withdraws what you accepted until you choose again. Elsewhere, opening it changes nothing until you pick an answer, and you can close it to keep what you have. Withdrawing is exactly as easy as accepting, which is the standard the law sets and a reasonable thing to expect regardless.

Because advertising is a new purpose and not something anyone agreed to before, every previous answer has been reset and the banner will appear once more even if you have answered it before. An answer you gave about analytics was not an answer about advertising, and we are not going to treat it as one. The same happened again on 29 September 2026, when affiliate links joined the advertising choice: a "yes" to Google Ads was not a "yes" to Lemon Squeezy.

Things that are not cookies

Six related technologies, disclosed here for completeness:

• sessionStorage — first-visit source. When you first arrive and analytics is on for you, we store the referring site and any campaign parameters from the link in your browser's sessionStorage. It never leaves your browser as a cookie and is erased when you close the tab.
• localStorage — advertising click identifier. If advertising is on for you and you arrived from one of our ads, the identifier from that link is kept for up to 90 days so a later purchase can be credited to it. With advertising off, it is never written.
• localStorage — your preferences. The application stores preferences such as your light/dark theme choice and editor view settings in localStorage so they persist between visits. This stays on your device.
• localStorage — your cookie choice. Your answer to the banner is recorded on your device so we do not ask again on every page. Storing your refusal is the only way to honour it.
• IndexedDB — writing kept while offline. If you edit a book while SmartKDP cannot be reached, the changes you made are kept in your browser until they reach us, and deleted once they have. They go nowhere else, and they are only ever offered back to the account that made them.
• Cache storage — the app's own files. Once you have opened the editor, the app's code, fonts and icons, and one "you're offline" page, are kept in your browser's cache so SmartKDP opens faster and can say so when there is no connection. No book, comment or personal data is kept there.

Device fingerprinting at sign-in

Separately from cookies, when you sign in we compute a device fingerprint and store it with your session, to detect account sharing and credential-stuffing attempts. It is a security measure, not an advertising one, and it is not affected by your analytics or advertising choice. It is described in full in our Privacy Policy.

Managing cookies

You can block or delete cookies in your browser settings. Blocking the session cookie will prevent you from staying signed in, because that cookie is how being signed in works. Clearing your browser storage also clears your recorded cookie choice, so you will be asked again on your next visit.

Changes

If we ever introduce a further non-essential cookie, we will update this page first, and in Europe ask you again before setting it. An answer you gave about analytics is not an answer about anything else.