Tinct - Cookie & storage declaration for your CMP

Last updated 27 days ago

Copy-paste material for declaring Tinct in your Consent Management Platform (OneTrust, Didomi, Axeptio, Cookiebot, Usercentrics, a custom banner, …). It describes exactly what the Tinct SDK stores on the visitor's device, under which conditions, and the wording you can use.

Two facts shape the whole declaration:

The SDK sets no cookies. It uses sessionStorage / localStorage only (most CMPs let you declare these as "HTML local storage" trackers).
What is stored depends on your snippet's analytics mode (basic or advanced, configured in Tinct) and on the visitor's consent. Consent is denied by default: without a positive signal, the SDK behaves as if the visitor refused.

Find your mode in the Tinct app, or run window.TinctAnalytics.getAnalyticsMode() on your page.

Which entries you need

Your setup	Declare
`basic` mode	The three exempt / strictly necessary entries below. No consent-gated tracker to declare.
`advanced` mode	The three exempt entries plus the Analytics (consent) entry, and — if you run paid campaigns — the Advertising (consent) processing.

Entries common to both modes (no consent required)

These are ephemeral, per-tab identifiers used solely to measure the visit itself. They expire when the tab closes and are never shared across sites. Most CMPs categorize them as strictly necessary / exempt audience measurement; if you prefer a conservative posture, put them under Analytics / Statistics.

Name	Type	Duration	Purpose
`tinct_session_id`	HTML `sessionStorage` (not a cookie)	Until the tab closes	Identifies the current browsing session so page views, scrolls and clicks on the personalized page can be grouped together. Rotates after 30 minutes of inactivity.
`tinct_session_last_activity`	HTML `sessionStorage` (not a cookie)	Until the tab closes	Timestamp of the last activity, used only to expire the session above. Contains no identifier.
`tinct_anonymous_id`	HTML `sessionStorage` (not a cookie)	Until the tab closes	Random per-tab visitor identifier used to distinguish one visitor's events from another's within the visit. In `basic` mode (or before/without consent) it never leaves `sessionStorage` and cannot recognize a returning visitor.

Suggested description (one entry for all three):

Tinct (tinct.ai) personalizes this landing page and measures how it performs. For this it keeps three technical identifiers in the browser's session storage (tinct_session_id, tinct_session_last_activity, tinct_anonymous_id). They are random, deleted when the tab is closed, and are not used to recognize you on a later visit or on other websites. Tinct sets no cookies.

Advanced mode — Analytics storage (requires consent)

Declare under Analytics / Statistics / Audience measurement. Wired to IAB TCF Purpose 1 or Google Consent Mode analytics_storage — the SDK detects both automatically, or call window.TinctAnalytics.setConsent({ storage: true|false }) from a custom banner.

Name	Type	Duration	Purpose
`tinct_anonymous_id`	HTML `localStorage` (not a cookie)	Persistent — until deleted or consent is withdrawn	Durable random visitor identifier enabling returning-visitor recognition across sessions. Written only after the visitor grants analytics-storage consent; deleted automatically if consent is later withdrawn.
`tinct_visit_referrer`	HTML `sessionStorage` (not a cookie)	Until the tab closes	The site that referred the visit (first-touch referrer), stored so attribution stays consistent across pages of the visit. Written only with analytics-storage consent.

Suggested description:

With your consent, Tinct (tinct.ai) stores a random identifier (tinct_anonymous_id) in the browser's local storage to recognize returning visitors to this site, and keeps the address of the site that referred your visit (tinct_visit_referrer) for the duration of the visit. This is used solely for first-party audience measurement of this site's landing pages. If you decline or later withdraw consent, the identifier is removed and only a temporary per-visit identifier is used.

Advanced mode — Advertising measurement (requires consent)

No additional storage is written for this. It gates whether ad-click identifiers already present in the landing URL (gclid, fbclid, li_fat_id, msclkid, ttclid, twclid, epik, sccid, gbraid, wbraid, dclid) are forwarded to Tinct for campaign attribution. Declare it as a Marketing / Advertising processing purpose. Wired to IAB TCF Purpose 7 or Google Consent Mode ad_storage + ad_user_data, or window.TinctAnalytics.setConsent({ adStorage: true|false }).

Suggested description:

With your consent, Tinct (tinct.ai) measures the performance of advertising campaigns by recording the ad-click identifier present in the page address when you arrive from an ad (for example Google Ads gclid or LinkedIn li_fat_id). Nothing additional is stored on your device for this purpose, and no data is shared with advertising networks. Without consent these identifiers are not collected.

Provider details (for the CMP's vendor sheet)

Field	Value
Vendor	Tinct (tinct.ai)
Tracker types	HTML `sessionStorage` / `localStorage` only — no cookies
Data recipients	Tinct's first-party collector; not shared with third parties or ad networks
Cross-site tracking	None — identifiers are scoped to your site
IAB TCF	Detected automatically; Tinct is not yet in the Global Vendor List, so gate on Purpose 1 (analytics storage) and Purpose 7 (ad measurement)
Google Consent Mode v2	Detected automatically: `analytics_storage` (analytics), `ad_storage` + `ad_user_data` (advertising)
Default without consent	Deny — ephemeral per-tab identifiers only, no durable storage, no ad-click ids

Full technical details (events, data collected, consent API): analytics-and-consent.md.