Cookie Policy

Cookies are small data files a website stores in your browser. First-party cookies are set for a Task Machine domain. Third-party cookies are set or read by another provider when its service is used on the page. Session cookies expire with a browsing session, while persistent cookies remain until their stated expiry or earlier deletion.

Task Machine also uses browser storage for limited session, preference, and analytics state. Browser storage is not a cookie, but it can remember information in a similar way and is covered by this policy where Task Machine or DataFast uses it.

Necessary cookies keep sessions, forms, account-specific browser features, saved generated-playbook references, and your analytics choice working. These cookies do not require analytics consent because they provide a service you request, protect the service, or remember the privacy choice itself. Blocking them can prevent sign-in, forms, or saved preferences from working.

Optional DataFast analytics cookies recognize returning public visitors, continue a consented journey across our current and legacy public domains, and connect that journey with a later checkout. DataFast runs in cookieless mode before acceptance and after rejection, without creating these persistent identifiers. We do not use advertising cookies.

Cloudflare security processing is separate from optional analytics. Its proxy and challenge services can process IP addresses, browser and TLS signals, and request metadata even when no Cloudflare cookie is set. Cloudflare's global processing can include the United States. Rejecting analytics does not disable these security services.

After acceptance, the DataFast SDK may mirror persistent identifiers in local or session browser storage to preserve analytics state. Rejecting or withdrawing acceptance removes the known persistent DataFast cookie and browser-storage keys and prevents Task Machine from forwarding those identifiers to checkout. Cookieless mode may still use session-only storage for continuity within the current browser tab.

Cookieless DataFast analytics runs on the public website by default. Before you accept analytics, and after rejection, DataFast can process page paths, referrers, campaign parameters, IP address, and user agent. It derives a server-side pseudonymous visitor identifier from IP address, user agent, site domain, and a salt that rotates about every 24 hours, and does not link visitors across our domains. After you select Accept, DataFast can additionally use persistent visitor and session identifiers, carry journey parameters between taskmachine.io and iterationlayer.com, and connect that journey with checkout attribution.

Product activity in the signed-in app is measured server-side through PostHog Cloud (EU) without analytics cookies, a browser SDK, or session replay. PostHog events use identifiers and bounded operational metadata rather than prompts or content.

The first public website visit presents equally available Reject and Accept choices for persistent analytics cookies. Rejecting does not limit public website access and keeps DataFast in cookieless mode. To review or change your choice later, remove the site's consent cookie in your browser's site-data controls and reload the page. Your choice and browser data are specific to each browser and domain, so you may need to repeat it on another browser, device, or Task Machine domain. Withdrawing acceptance returns DataFast to cookieless mode, removes known persistent DataFast identifiers from the browser, and stops forwarding those identifiers to checkout.

You can also delete or block cookies in your browser. Browser controls can remove necessary cookies too, which may sign you out, reset saved proposal references, or prevent parts of the service from working.