Cookie policy

Last updated: July 30, 2026

This is a working draft for engineering and pilot fleets — not a substitute for counsel-reviewed cookie documentation before general availability.

What this covers

This policy explains the cookies and similar technologies (including browser local storage) that DirtFleet.app sets, and the choice you get over the ones that aren't required to run the site. DirtFleet.app is a DBA of Aviat Group, LLC. See our privacy policy for how we handle the data behind your account.

Strictly necessary

These run the site and can't be switched off — signing in, keeping your session secure, and remembering settings like locale and theme.

Name	Provider	Purpose	Duration
authjs.session-token / __Secure-authjs.session-token	DirtFleet (first-party)	Keeps you signed in.	Session / up to 30 days
authjs.csrf-token, authjs.callback-url	DirtFleet (first-party)	Protects the sign-in flow from cross-site request forgery.	Session
dirtfleet-locale	DirtFleet (first-party)	Remembers your chosen language.	1 year
dirtfleet-theme, dirtfleet-cookie-consent	DirtFleet (first-party, local storage)	Remembers your light/dark preference and your cookie choice itself. Not sent to a server.	Until cleared

Analytics (optional)

We use Google Analytics 4 to understand aggregate usage — page views, referrers, and bounce rate. It only runs with your consent: we ship it with Google Consent Mode v2, defaulting to denied until you accept, and we honor your browser's Do Not Track signal by not loading it at all. We don't run advertising cookies or sell data to ad networks.

Name	Provider	Purpose	Duration
_ga, _ga_<container-id>	Google Analytics (third-party)	Distinguishes visitors to measure aggregate product usage.	Up to 2 years
_gid	Google Analytics (third-party)	Distinguishes visitors within a 24-hour window.	24 hours

Our own page-view counter (no cookie)

Separately from Google Analytics, we count page views in our own database so we can see which pages are useful without logging into someone else's console. It sets no cookie and stores no IP address. To count “people” rather than clicks, we store a one-way salted hash of your IP and browser string that is regenerated every day at midnight UTC — yesterday's hash can't be linked to today's, and neither can be reversed back to you. We also record the page path, how long the page was open, the referring site's domain (never its full URL), a coarse device type, and the country your network resolves to.

A random per-tab id in sessionStorage groups the pages of a single visit together; it is destroyed when you close the tab. If your browser sends Do Not Track or Global Privacy Control, none of this runs at all.

Your choice

You made a choice the first time you visited (or you can make one now). You can change it at any time — it takes effect immediately and doesn't require reloading the page.