Cookie and browser storage list

Draft for counsel review. This is a limited staging inventory, not a complete list of production cookies or a statement that consent controls have passed testing.

We inspected ten pages on gridwise.webflow.io on September 29, 2026, from 06:10:19 to 06:15:47 UTC, using Dia with controller revision 2026-09-29.3. Each capture reported Analytics, Marketing, and Personalization enabled. Dia’s content blocker blocked vendor requests, so the absence of optional cookies does not prove those tools never use storage or that the consent system blocked them.

The browser export does not include HttpOnly cookies, all third-party frame storage, or complete network activity. A before-choice capture at 06:09:15 UTC showed no cookies visible to the export, but contained the same local and session storage names listed below. Presence in that snapshot does not establish when each item was created. Further testing without a content blocker is required.

Cookie times below are the actual expiry values observed in that browser. Remaining days are measured from the cited capture, not a vendor default or the original lifetime. Browser storage lifetime does not establish how long a vendor keeps information on its servers.

Observed on the inspected staging build

The two cookies below appeared in every ten-page capture. They were host-only on gridwise.webflow.io, used path /, and were marked Secure and SameSite=Lax. The expiry measurements use the homepage capture at 06:10:19 UTC. Local storage names were also present across the ten pages.

StorageNameVendorPurposeCategoryObserved lifetime or retention
Cookiefs-consentConsent ProRemembers the consent choice.EssentialExpires 2027-09-29 06:10:02 UTC; 365.00 days remained at capture.
Cookiegw_consentGridwisePreserves the choice, categories, decision source, and time.EssentialExpires 2027-09-29 06:10:02 UTC; 365.00 days remained at capture.
Local storagecolorThemes_dataSite theme code; exact writer unverifiedThe site uses colorThemes for navigation colors. The purpose of this stored key has not been confirmed.Unconfirmed; possible display functionalityNo browser expiry field. Application deletion or retention is unverified.
Local storagecolorThemes_publishDateSite theme code; exact writer unverifiedThe stored key appears related to theme caching; this is an inference from its name, not a verified purpose.Unconfirmed; possible display functionalityNo browser expiry field. Application deletion or retention is unverified.
Local storageZD-suidZendeskThe vendor documents a session identifier used for analytics on pages with its support widget.Analytics according to Zendesk; observed in the earlier support configurationNo browser expiry field. Actual vendor retention or deletion is unverified.

Additional session storage observed

These names were also present before a consent choice and after acceptance. The exact vendor and purpose are not established by a key name alone.

StorageNameVendorPurposeCategoryObserved lifetime or retention
Session storageZD-suidZendeskThe same named identifier was present in session storage; the exact use of this copy was not verified.Requires reviewAssociated with the page session; application deletion and browser session restoration were not tested.
Session storageZD-buidUnverifiedPurpose not verified.UnconfirmedAssociated with the page session; application deletion and browser session restoration were not tested.
Session storage[site key].clientIdUnverifiedPurpose not verified. The site-specific prefix is omitted here.UnconfirmedAssociated with the page session; application deletion and browser session restoration were not tested.

Historical cookies from the previous build

These seven cookies were observed on the previous published staging build at September 29, 2026, 05:57:08 UTC, in an existing browser profile. They were not observed in the later ten-page capture. Their presence does not prove the newer build creates them. Creation times and original lifetimes are unknown. All used path /; the browser reported gridwise.webflow.io as the domain except the two HubSpot cookies, which were host-only.

StorageNameVendorPurposeCategoryObserved lifetime or retention
Cookie_fbpMetaSupports advertising tracking and targeting.MarketingExpires 2026-11-11 05:39:46 UTC; 42.99 days remained at capture.
Cookie_gaGoogle AnalyticsDistinguishes visitors for website measurement.AnalyticsExpires 2027-09-17 05:39:05 UTC; 352.99 days remained at capture.
Cookieajs_anonymous_idSegmentAssociates analytics calls with the same anonymous visitor.AnalyticsExpires 2027-08-13 05:39:46 UTC; 317.99 days remained at capture.
Cookie__hstcHubSpotRecords visitor history, visit timestamps, and session count.MarketingExpires 2027-02-09 05:39:46 UTC; 132.99 days remained at capture.
CookiehubspotutkHubSpotRecognizes a visitor and supports duplicate-contact detection during form submission.MarketingExpires 2027-02-09 05:39:46 UTC; 132.99 days remained at capture.
Cookie_hjSessionUser_2672958HotjarExact purpose remains unverified from an accessible official source.Analytics, proposed classificationExpires 2027-08-13 05:39:46 UTC; 317.99 days remained at capture.
Cookie_ga_1MJ94VN0BXGoogle AnalyticsRetains browsing-session state.AnalyticsExpires 2027-09-17 05:39:48 UTC; 352.99 days remained at capture.

Optional tools whose current storage remains unverified

These tools are expected from the implementation or earlier evidence. This list is separate from the storage observed in the ten-page capture.

ToolWhy it remains listedCategory and verification limit
Google Tag Manager and Google AnalyticsThe existing container and its analytics tags remain in the implementation.The whole container is assigned to Marketing; browser loading and delivery need an unblocked test.
Meta and LinkedInAdvertising pixels or tags remain in scope.Marketing. Their final-build storage and receipt are not established by these captures.
HubSpotWebsite and form measurement remain in scope.Marketing. Actual modules and storage require an unblocked test.
HotjarBehavior analysis remains in scope.Analytics. No Hotjar cookie was observed in the ten-page capture.
SegmentAnalytics collection remains enabled under the Analytics category.Browser checks remain in scope. Server forwarding, debugger receipt, and audience exports are deferred for staging.
YouTubeEmbedded videos remain in scope.Marketing plus an explicit video request. Playback storage was not established by this capture.

Other services and remaining review

Cloudflare Turnstile form protection and Datawrapper chart content also appeared in the browser observations, without an observed cookie row in this capture. Their presence should not be omitted merely because no cookie was listed. Datawrapper’s exact pt.dwcdn.net endpoint behavior and its category remain under review; the vendor’s public descriptions are inconsistent. No Datawrapper cookie name or lifetime is inferred here.

A later controller revision is being prepared to restrict Zendesk analytics using its native functional-storage setting. That change has not been verified by the captures summarized here. The presence of ZD-suid must therefore remain visible in this draft. Segment’s server-side review is deferred for staging, with Segment still subject to its browser Analytics consent gate. Neither limitation is a test pass or production approval.

Purpose sources

Vendor documentation supports purpose descriptions, not the observed expiry measurements. The Hotjar purpose and several storage mappings remain unverified.

Pages inspected

California Privacy Notice ·