Cookie Policy

1. Essential storage

XGM uses local storage in your browser, not tracking cookies, for essential preferences: your consent choice (xgm_cookie_consent_v2), your theme (xgm.theme.v1) and recent checks of server-backed tools (xgm_tool_history_v1, removable with Clear history on any tool page) and reports you choose to save (xgm.history.v1, managed on the History page). A service worker keeps a cache of the site's own files, including the pages of tools you open (without the query string), so browser-based tools work offline. None of this is sent to XGM.

Branded PDF keeps the organisation name and logo you enter in local storage (xgm.brand.v1) so the next cover uses them; clear the name and remove the logo to delete them. They are never sent to XGM.

2. Operational analytics

Only after you choose Accept all, XGM records first-party page view and tool usage events (page path, tool name, timestamp). They help improve reliability and understand which tools are useful. With Essential only, these events are not sent.

3. No secret inputs

Do not paste passwords, API keys, private tokens, confidential documents or sensitive personal information into public tools, forms or report fields.

4. Managing consent

The cookie banner lets you keep Essential only or choose Accept all. Google Analytics and first-party analytics events start only after Accept all. You can change your choice at any time with the Privacy choices control on the site, or clear XGM site storage in your browser settings.

5. Google Analytics

When you choose Accept all, XGM may load Google Analytics to measure public page traffic and engagement. XGM disables Google signals and advertising-personalization signals in its configuration. Essential-only visitors do not load the Google Analytics script.

When it loads, Google Analytics is told your choice through Google Consent Mode: analytics storage granted, and advertising storage, ad user data and ad personalisation denied. XGM does not ask for advertising consent. Choosing Essential only later sends all four as denied, and Google Analytics is not loaded again.