Varduno Cookie Notice
Effective date: September 13, 2026. Inventory observed September 13, 2026.
Varduno is operated by Carl Gunnar Daniel Thunberg, 446 Cloverdale Road, Ottawa, Ontario K1M 0Y6, Canada. Contact privacy@varduno.com.
Your choices
On varduno.com, Cookie Settings lets you accept or reject Google Analytics managed through Cloudflare Zaraz. Optional HubSpot visitor tracking through Zaraz is currently disabled. Loading our enquiry form is a separate choice: the form connects to HubSpot only when you select “Load HubSpot form”. You can email us instead. HubSpot receives technical information when its form loads, and the information you choose to submit.
The app at app.varduno.com uses Base44 authentication, browser storage and platform activity logging. A Mixpanel identifier was observed before sign-in without a consent prompt. The marketing-site Cookie Settings does not control these Base44 technologies. We are seeking a supported way to control the app's optional analytics. Session recording has been disabled. Please contact us if you need assistance with these limitations before using the app.
Changing your marketing consent affects subsequent activity of the tools it controls; it does not erase information already received by providers. Some previously stored identifiers may remain until expiry or browser deletion. Browser settings can remove or block cookies and storage, but may sign you out or prevent features from working. Closing a HubSpot form does not undo requests already sent or delete cookies it set.
Observed marketing-site cookies
Lifetimes below are the approximate expiry periods actually displayed in the audit browser, not a guarantee of every visitor's expiry. Cookies may be refreshed on later visits. A session cookie has no fixed expiry date and can persist when a browser restores a session.
| Name | Provider / domain | Purpose and category | Observed lifetime |
|---|---|---|---|
| __cf_bm | Cloudflare; .varduno.com | Bot protection; security | 30 minutes |
| cf_clearance | Cloudflare; .varduno.com | Security challenge clearance; security | 1 year |
| __Host-appgarden-visitor | Sites hosting; varduno.com | Hosting visitor identifier; exact processing purpose under verification | 90 days |
| cf_zaraz_client | Cloudflare Zaraz; .varduno.com | Zaraz client storage; exact use under verification | 1 year |
| zaraz-consent | Cloudflare Zaraz; .varduno.com | Remembers privacy choices; consent management | 1 year |
| cfz_google-analytics_v4 | Cloudflare Zaraz / Google Analytics; .varduno.com | Analytics identifier | 1 year |
| cfzs_google-analytics_v4 | Cloudflare Zaraz / Google Analytics; .varduno.com | Analytics session identifier | Session |
| cfz_hubspot | Cloudflare Zaraz / HubSpot; .varduno.com | Previous optional HubSpot tracking; tool now disabled | 1 year |
| cfzs_hubspot | Cloudflare Zaraz / HubSpot; .varduno.com | Previous optional HubSpot session tracking; tool now disabled | Session |
| __cf_bm | Cloudflare for HubSpot; .hsforms.net and .hsforms.com | Security for the external form | 30 minutes |
Observed application cookies and storage
Cookies scoped to .varduno.com may be available on both the marketing site and app. Seeing a cookie on a second domain does not necessarily mean it was newly created there.
| Name | Provider / domain | Purpose and category | Observed lifetime |
|---|---|---|---|
| base44_access_token | Base44; app.varduno.com | Authentication; necessary for signed-in access | 90 days |
| base44_referrer_origin | Base44; app.varduno.com | Origin/referral context; exact processing purpose under verification | 30 days |
| __cf_bm | Cloudflare for Base44; .base44.com | Bot protection; security | 30 minutes |
| mp_eff913a25a5a2642acc7794bb28dc621_mixpanel | Base44 / Mixpanel; .varduno.com | Analytics identifier; currently outside marketing consent controls | 1 year |
The app also stored these local-storage keys: base44_access_token, token, base44_analytics_session_id, base44_app_id, base44_from_url, base44_functions_version, and i18nextLng. They support authentication, app context, activity measurement and language settings; the exact use of each platform-managed key remains under verification. Local storage has no browser-enforced expiry date and remains until cleared by the app or browser. Authentication values should never be copied or shared.
The session-storage key mp_tab_id_mixpanel_eff913a25a5a2642acc7794bb28dc621 identifies a tab for Mixpanel-related activity. Session storage normally lasts for the tab session, subject to browser restoration behavior.
Stripe billing
The audited Stripe customer portal was in test mode. It used the following cookies; this was a billing-portal observation, not a completed live purchase or a complete live-checkout inventory.
| Name | Provider / domain | Purpose and category | Observed lifetime |
|---|---|---|---|
| __stripe_mid | Stripe; .billing.stripe.com | Payment fraud prevention | 1 year |
| __stripe_sid | Stripe; .billing.stripe.com | Payment session / fraud prevention | 30 minutes |
| __Secure-sid | Stripe; .stripe.com | Stripe session; detailed purpose under verification | 30 minutes |
| cid | Stripe; .stripe.com | Stripe identifier; detailed purpose under verification | 90 days |
| __cf_bm | Cloudflare for hCaptcha; .hcaptcha.com | Security / bot protection | 30 minutes |
Sign-in providers and external payment pages may set additional cookies on their own domains according to the method you choose and their privacy notices. Our Cookie Settings does not control cookies on those providers' own sites.
Inventory scope and updates
This inventory records observed technologies and identifies remaining uncertainties. It is not a claim that every optional technology is blocked by one banner or that every possible sign-in, payment and provider flow has been tested. We update the notice as we verify provider behavior or change services. See our Privacy Policy for other processing, international transfers, AI use and privacy requests.