Cookie Policy

1. What cookies are

A cookie is a small text file stored on your device when you visit a website. Cookies allow a site to recognize your browser across page loads — for example, to keep you logged in, remember a preference, or protect a form submission from being forged by another site. We also use similar technologies (local storage, session storage) where the same explanation applies.

2. Our approach

We try to use the smallest set of cookies needed to make the site work. We do not run advertising cookies, cross-site tracking pixels, social-media trackers, or third-party retargeting on polycreek.org. The cookies we do set fall into two narrow categories: strictly necessary and analytics.

3. Cookies we use

3.1 Strictly necessary

These cookies make the site function. They cannot be turned off because without them the site would not work. They do not store information that identifies you personally beyond what is needed for the request you have just made.

• Session cookie (polycreek_session): keeps you signed in to the Aletheia member dashboard between page loads. Expires when you close your browser or sign out.
• CSRF token (XSRF-TOKEN): prevents cross-site request forgery on forms (contact, newsletter, data requests, dashboard actions). Required by the Laravel framework. Session-scoped.
• Cookie consent state: remembers your choice on this banner so we do not show it again on every visit. Stored for 12 months.

3.2 Analytics

We use privacy-respecting, server-side or first-party analytics to count visits and understand which content is useful. Where analytics cookies are set, they are aggregated, do not build cross-site profiles, and are not shared with advertising networks.

• Aggregate page-view counters: track which pages are visited and from which referrer. No precise IP is retained beyond the period needed for abuse prevention.
• We do not use Google Analytics with advertising features, Meta Pixel, TikTok Pixel, or similar. We do measure whether a Google Ads click led to a donation, which is described in the next section.

3.3 Advertising measurement

We advertise through the Google Ad Grants program, which gives nonprofits free search advertising. To keep that grant we have to be able to tell Google whether an ad click resulted in a donation. These cookies exist for that purpose and no other:

• Google Ads tag (cookies beginning _gcl_): set by Google on our site. If you arrive from a Google ad, your click carries an identifier that these cookies record.
• Click reference (pc_click_id and pc_click_type): set by us, and only if you arrived from a Google ad. They hold that same click identifier so that our donation form, which runs inside an embedded Zeffy page and cannot read our website address, still receives it. Stored for 90 days.

If you then donate, we report the donation to Google Ads. What we send is limited to the click identifier, the amount, the currency and the time. We do not send Google your name, your email address, your postal address, or any payment details, and we do not use the hashed-identity matching that Google offers for this purpose. If you did not arrive from an ad, no click reference is stored and nothing is reported.

3.4 Third-party services we link to

Some pages link to or embed third-party services that may set their own cookies once you interact with them. We do not control those cookies; their providers do, under their own policies:

• Zeffy (donation processing) — our donation form is provided by Zeffy and embedded on our donate page. Zeffy sets its own cookies in that form, and it is also the processor if you complete a gift on zeffy.com directly.
• Candid / GuideStar — the transparency seal in our footer is loaded from widgets.guidestar.org.
• NCMEC and partner sites — outbound links only; we do not set cookies on their behalf.

4. Your choices

You have several ways to control cookies on polycreek.org:

• Consent banner. On your first visit, you can accept or decline non-essential cookies. Strictly necessary cookies are not affected by this choice because the site cannot function without them.
• Browser settings. Every major browser lets you block or delete cookies. See the help pages for Chrome, Firefox, Safari, and Edge. Blocking session and CSRF cookies will break sign-in and form submissions.
• Global Privacy Control. We honor browser-level GPC and Do Not Track signals where they reflect a user's choice not to be tracked.
• Withdraw consent. Clear your browser's cookies for polycreek.org and the banner will appear again on your next visit.

5. Children

polycreek.org is not directed to children under 13 and we do not knowingly use cookies to collect data from children. Aletheia, our detection platform, operates without setting cookies in end-user browsers — see the Privacy Policy Part B for how Aletheia data is processed.

6. International users

If you visit from the EU/UK, we treat your consent under the GDPR/UK GDPR and ePrivacy rules: strictly necessary cookies do not require consent, and analytics cookies are only set after you accept. If you visit from California, we treat your choices under the CCPA/CPRA and honor GPC.

7. Changes to this policy

We may update this Cookie Policy when our practices change, new services are introduced, or the law evolves. Material changes will be reflected in the “Last updated” date above. We recommend reviewing this page periodically.

8. Contact

Questions about cookies or this policy:

• Email: privacy@polycreek.org
• Exercise your data rights: use our Request My Data form.
• Mail: Polycreek, 1905 Sherman Street, Suite 200, Denver, CO 80203, United States