Cookie policy

Arrmma · arrmma.com · In force since 10 November 2026

How you decide

If your connection is identified as European, the "Privacy and cookies" notice appears on arrival. Elsewhere, or if the country cannot be identified, it does not open automatically: you can open preferences from the footer or your account. The notice offers three options at the same level: Accept optional, Reject optional and Customize. In Europe, or when your country is unknown, optional cookies stay off until you choose; outside Europe, analytics cookies are set from the first visit until you reject them. Advertising is never turned on without your acceptance. Outside Europe and without GPC/DNT, Arrmma measures page loads from the first visit with a random session and visitor (no IP or fingerprint): public path without parameters, language, referring site, campaign, device type and approximate country. These views store no IP address, fingerprint or country. This count cannot identify unique people or attribute their purchases; rejection stops it. Outside Europe and without GPC/DNT, Google Analytics 4 measures pages and catalogue interactions with its analytics cookies from the first visit; advertising storage remains denied. No account identifiers are sent; confirmed purchases are sent with their transaction number, amount and currency, without personal data. You can stop this measurement with Reject optional in Privacy and cookies in the footer; a saved rejection is respected. In Europe or if the country is unknown, Google waits for acceptance. You can change your mind at any time with the "Privacy and cookies" button in the site footer or in "My account › Privacy & preferences". Rejecting limits nothing: you can sign up, buy, download and reset your password the same.

We keep your choice with its version and date for 6 months; after that, or if this policy changes, the choice needs to be renewed. The automatic notice reappears only in Europe; elsewhere you can renew your choice in preferences. If your browser sends Global Privacy Control or Do Not Track, analytics and advertising stay off even if you accept them. With an account, your choice is also saved to the account; when you sign in, if the browser and account choices differ, the more restrictive one applies.

Necessary (always on)

"arrmma_sesion" · Arrmma · your account session (random value; our servers only keep its hash) · 30 days or until you sign out. "lang" and "arrmma_lang" · Arrmma · language · 1 year. "arrmma_consent" · Arrmma · your cookie choice, with version and date · 6 months. "arrmma_pending_email" · Arrmma · email awaiting confirmation after sign-up · 1 hour. "arrmma_demo" · Arrmma · temporary pass to open an authorised demo, only on its path · 30 minutes. On Stripe's payment page (checkout.stripe.com) Stripe's cookies apply under its own policy. In local storage, without an account, "arrmma_copias_tutorial" remembers how many times you copied a prompt to show the tutorial only the first two times.

Measurement and analytics cookies

"arrmma_pv" · Arrmma · random browsing-session id for our own measurement, which with each view stores the path without parameters, language, referrer, campaign, device type, approximate country of the connection and, if you are signed in, your account (no IP or fingerprinting) · 30 minutes from the last view. "arrmma_attr" · Arrmma · first and last design or component you interacted with and the arrival campaign, signed and with no personal data, to know what led to a sign-up or purchase · 30 days. "arrmma_vid" · Arrmma · random visitor id to tell new from returning visits in our own measurement, with no personal data · 13 months. Under the same rule we also measure which cards are seen (at least half visible for 1 second), clicks and the buy, Pro and sign-up buttons. "arrmma_dl" · Arrmma · queue of events with no personal data (confirmed sign-up, sign-in, download or demo) for the next page · 10 minutes. In local storage, "arrmma_tx_…" prevents sending the same purchase twice.

Google Analytics 4 through Google Tag Manager · Google: Outside Europe and without GPC/DNT, Arrmma measures page loads from the first visit with a random session and visitor (no IP or fingerprint): public path without parameters, language, referring site, campaign, device type and approximate country. These views store no IP address, fingerprint or country. This count cannot identify unique people or attribute their purchases; rejection stops it. Outside Europe and without GPC/DNT, Google Analytics 4 measures pages and catalogue interactions with its analytics cookies from the first visit; advertising storage remains denied. No account identifiers are sent; confirmed purchases are sent with their transaction number, amount and currency, without personal data. You can stop this measurement with Reject optional in Privacy and cookies in the footer; a saved rejection is respected. In Europe or if the country is unknown, Google waits for acceptance. With acceptance it uses Google's "_ga" and "_ga_GQZPT701D6" cookies on this domain (up to 2 years). It does not load on account, sign-up, sign-in, admin or payment pages (except the payment confirmation, which records the purchase), and before loading we strip codes and sensitive parameters from the address. It receives these events: viewing a design or component, selecting from a list, starting checkout, confirmed sign-up, sign-in, copying a prompt, authorised download or demo, choosing Pro and purchase or subscription (amount, currency, plan and a transaction identifier that does not identify you). It does not receive your email, name, phone, account identifier or prompt text; Google Signals, personalised advertising and user-provided data are turned off.

"arrmma_ref" · Arrmma · affiliate link (affiliate code, click id, date and whether it was your first observed visit; signed, no personal data) · 30 days · set when following an affiliate link with analytics accepted and without Global Privacy Control; if you have not chosen yet, the referral travels in the landing page address as a 15-minute signed token ("ar") and only becomes a cookie if you accept. It tells whether your first visit came through an affiliate so their commission on your purchases can be attributed; it is deleted when you reject or withdraw analytics. A referral code typed by a buyer at checkout uses no cookies.

Affiliate link click record (not a cookie and not stored in your browser): when you follow an approved affiliate’s link, our server records the click and the visit to the landing page together with an irreversible daily digest, computed with a secret key from the date, the IP address and the browser, to avoid counting the same click twice; the IP is not stored. This record is made even before you choose or after you reject analytics; rejection prevents the referral cookie and token. Details in the privacy notice, “Affiliate links and codes”.

Advertising (optional)

We use no advertising, pixels or ad tags today. If added, they will be described here and will only work with your consent.

What happens when you reject or withdraw

If you reject, "arrmma_pv" and "arrmma_attr" are not created and no optional measurement is sent. If you withdraw a consent you gave, we delete "arrmma_pv", "arrmma_attr", "arrmma_ref" and this domain's "_ga" cookies from your browser, stop recording optional events and, if Google Tag Manager was loaded, reload the page to stop it. What was sent before withdrawing is not deleted by this button; to request its deletion write to support@arrmma.com. Your purchases, their delivery and payment confirmation work the same because they only use necessary data, never for optional tracking.