In effect since August 26, 2026. Marvel Mirror LLC, operator of YardBooth · 2501 Chatham Rd #5694, Springfield, IL 62704 · hello@yardbooth.com
The short version
Browsing and buying on YardBooth requires no account and no YardBooth login cookie. Cloudflare Access uses strictly necessary security cookies after an approved seller or administrator verifies an emailed one-time code. Analytics is first-party, uses no cookie, stores no IP address, and can be turned off from every page.
Essential Cloudflare Access cookies
| Name | Purpose | Duration |
|---|---|---|
| Cloudflare Access authentication cookie | Lets Cloudflare prove that the browser completed email verification for the protected seller manager or admin dashboard. Cloudflare controls the cookie name and security attributes; YardBooth page scripts cannot read the signed Access identity. | Until the configured Access session expires, the session is revoked, browser data is cleared, or a private window is closed. |
These cookies are required only for the protected manager and admin services. YardBooth does not create its own seller-login cookie or store login-token hashes in D1. Turning off analytics does not remove Access cookies because they are security controls, not measurement.
Local browser choices
| Name | What it holds |
|---|---|
yardbooth-analytics-notice-seen | One “yes” value so the analytics notice does not appear on every page. |
yardbooth-analytics-opt-out | One “yes” value when analytics is off in that browser. |
These are local-storage entries, not cookies. They do not identify you and do not leave the browser.
Exactly what analytics sends
One YardBooth endpoint receives a generated event ID, event name, path without its query string, optional coarse button location, and time. D1 uses the event ID as a primary key, so a repeated network delivery cannot create a second count.
There is no Google Analytics, Meta Pixel, advertising tag, cross-site identifier, session recording, fingerprint, or analytics cookie.
Turning analytics off
- Choose No thanks in the first-visit notice, or
- Open Privacy, always available at the bottom-right of every page, or
- Enable Global Privacy Control in a browser that supports it, or
- Use YardBooth’s analytics-free test link. It turns counting off before that page view and remembers the choice in that browser.
Turning it off prevents future analytics events from that browser. It cannot retract a coarse count already sent before the choice. Measurement runs on the first page view unless Global Privacy Control, the test-link parameter, or a stored opt-out is already present.
A different device, browser, or newly opened private profile has separate storage and begins with its own choice.
Turnstile
The sale-request form uses Cloudflare Turnstile to distinguish people from automated abuse. Turnstile processes browser and device signals for that security check. YardBooth receives only the short-lived result token and validates it on the server; it does not use that token for advertising or analytics.