Cookie policy
Effective date: August 31, 2026
Last updated: October 26, 2026
Version: 2026-10-26
This policy covers the TinyBond website at tinybond.app — the home page, the blog, and these legal pages. It sits alongside the Privacy Policy, which covers everything else we do with data. It does not cover the TinyBond app, which is not yet available.
TinyBond is a project of TinyBond LLC, a Massachusetts limited liability company in the United States. Questions about anything here go to hello@tinybond.app.
What this is about
A cookie is a small file a website asks your browser to keep. Some are ours and some belong to companies we use. Browsers also have a second kind of storage, called local storage, which works the same way for our purposes — this policy covers both, and says "cookie" for both.
Nothing runs before you say yes
The first time you arrive, a banner asks what you're comfortable with. Until you answer it, Google Analytics, the Meta Pixel and the Pinterest tag are not loaded at all — not a delayed version, not a cookieless one. Google's, Meta's and Pinterest's code is never fetched, so it cannot set anything or see that you were here.
No other analytics or advertising script runs instead.
Strictly necessary storage is the exception. It is exempt from consent because the site cannot do its job without it — one item remembers which language you chose, and one remembers the answer you gave the banner, so we don't ask again on the next page.
If you say no, the site works exactly the same. There is no wall, no nag, and nothing is withheld.
Every cookie we set
This is the complete list of cookies set on this site. While Advertising is switched on, Meta and Pinterest can also read and set cookies on their own domains, facebook.com and pinterest.com — Pinterest's _pinterest_ct_ua, for example, does the same job as _pin_unauth from Pinterest's side. Those are covered by Meta's and Pinterest's own cookie policies.
| Name | Set by | What it does | How long | Category |
|---|---|---|---|---|
| tb-consent | TinyBond (local storage) | Remembers your answer to the banner, and which version of it you answered, so we don't ask again on every page | 12 months, then we ask again | Strictly necessary |
| tb-lang | TinyBond (local storage) | Remembers whether you're reading in English or Portuguese | Until you clear your browser storage | Strictly necessary |
| _ga | Tells one browser apart from another, so we can count visitors rather than page loads | 13 months | Analytics | |
| _ga_* | The same job for this specific site — the name ends in our measurement ID | 13 months | Analytics | |
| _fbp | Meta | Lets Meta measure whether an ad led someone here | 90 days | Advertising |
| _fbc | Meta | Records that you arrived from a Meta ad. Only set if the link you followed carried Meta's click identifier | 90 days | Advertising |
| _pin_unauth | Tells one browser apart from another when Pinterest can't match the visit to a Pinterest account, so it can tell whether an ad led someone here | 1 year | Advertising | |
| _epik | Records that you arrived from a Pinterest ad. Only set if you came here from one | 1 year | Advertising | |
| _derived_epik | Remembers a match Pinterest made between this visit and a Pinterest account without using a cookie | 1 year | Advertising | |
| _routing_id | Keeps your browser on one version of Pinterest's tag while Pinterest rolls out updates | 1 year | Advertising |
The three categories
Strictly necessary — always on, and not something you can switch off, because the site cannot work without it. The two items above are the whole of it. They stay on this device; nothing about them is sent anywhere.
Analytics — off until you turn it on. Google Analytics tells us how many people arrive, which pages they read, roughly where in the world they are, and whether they join the waitlist. We use it to decide what to write next. We do not send Google your name, your email address, or anything you type into a form, and the address of the page is stripped of anything after the "?" before it is sent.
Advertising — off until you turn it on. The Meta Pixel lets Meta measure whether our ads are reaching parents, and show them on Facebook and Instagram, including to people who have visited this site before. The Pinterest tag does the same for our ads on Pinterest. Under California law this counts as "sharing" personal information for cross-context behavioral advertising, so it is something you can switch off at any time and something we honor automatically when your browser asks — see below.
Who receives the data, and where it goes
Google LLC, in the United States, receives the analytics data. Meta Platforms, Inc. and Pinterest, Inc., both in the United States, receive the advertising data. All three are certified under the EU–US Data Privacy Framework, and our arrangements with them also rest on the European Commission's Standard Contractual Clauses. For transfers out of Brazil we rely on the same mechanisms, as permitted by Article 33 of the LGPD.
How long the data is kept
The cookies themselves expire on the schedule in the table. Separately, Google Analytics keeps the underlying event data for 14 months from your last visit, which is the setting we have chosen and the longest a standard Analytics property allows. Meta's and Pinterest's retention is governed by their own policies.
Saying yes, saying no, changing your mind
Withdrawing is exactly as easy as consenting, which is what both the GDPR (Article 7(3)) and the LGPD (Article 8 §5) require.
- On the banner, "Accept all" and "Reject all" sit side by side, the same size. "Choose" opens the categories so you can take one and not the other.
- Afterwards, "Cookie settings" in the footer of every page reopens the same panel. Change anything, and it takes effect immediately: the tag is told to stop, and the cookies in the table above are deleted from this browser.
- "Your Privacy Choices", also in the footer, is the one-click version for California and the other US states with an opt-out right. It switches advertising off straight away, without asking you anything.
- Your browser's own settings can block or delete cookies for any site. Doing that here costs you nothing — the site does not depend on any of them.
We ask again if this policy's version changes, and in any case after twelve months.
Global Privacy Control
If your browser sends the Global Privacy Control signal, we treat that as a "no" to analytics and advertising, and we act on it the moment you arrive — before the banner, and even if you had said yes here before. The preference panel will tell you it is being honored. This is what the CPRA in California and the Colorado Privacy Act require, and we apply it to everyone rather than checking where you are.
Changes
If we add a tool, or change what an existing one does, we update this page, bump the version number at the top, and ask everyone again. A choice recorded under an older version never carries over to a new one.
Contact
TinyBond LLC
Massachusetts, United States
hello@tinybond.app