No cookies. None.
Not analytics, not advertising, not third-party, not session. This build never writes one, so there is nothing to consent to.
Privacy and storage
What this site stores, in full
Short version: no cookies, no analytics, no third parties, and three keys in your own browser holding choices you made yourself. The long version is below, and it is the whole of it.
The short version
Nothing about you leaves this page
Three keys, on your device
Theme, palette, text size, contrast, motion, link underlines — plus the rebrand tool's colours, and your yes/no about saving them.
Nothing is transmitted
Those keys are read by this page and written by this page. No script here sends them anywhere, and no server here reads them.
Every key, named
The complete storage inventory
This is not a summary of a category of storage. It is the list. If a fourth key appears in this site, this table gains a fourth row.
| Key | What it holds | When it is written | How long it lasts |
|---|---|---|---|
dryside.prefs | Theme (light/dark/system), colour palette, text size, contrast, motion and link-underline settings | When you change something in the accessibility widget or the theme control | Until you clear it, or press "Don't save anything" in the storage notice |
dryside.brand | The colours and identity typed into the built-in rebrand tool, so a demo you set up survives a refresh | Only if you open the rebrand customiser and change something in it | Until you reset the customiser or clear the key |
dryside.consent | Whether you said the two keys above may be saved — a single yes/no | When you press either button in the storage notice at the foot of the page | Until you clear it. If you said no, the other two keys are not written |
All three live in localStorage, on the device you are reading this on.
localStorage is not sent with requests the way a cookie is. Nothing on this site reads
these values on a server, because this site has no server-side code at all — it is a set
of static files.
Forms and the phone
Where a submission actually goes
There are two lead forms on this site — the quote form and the contact form. Both are written to post their fields as JSON to a webhook address held in the site configuration.
In this demonstration build both of those addresses are empty strings. With no address to post to, the request is never made. Whatever you type stays in the browser tab and disappears when you close it. That is a property of this demo, not a promise about a live site: if this design were deployed for a real roofing company, those fields would be filled in with that company's own lead system, submissions would travel there, and this page would have to be rewritten to name it.
There is one more thing worth naming, because leaving it out would make this page a
half-truth. Every page carries a small script that, when you click a tel:
link, pushes an object onto window.dataLayer recording that a phone link was
clicked and which button it was. That is the standard hook a tag manager reads.
No tag manager is loaded on this site, so the array is created, an object is
pushed into it, and nothing ever reads it. It is a variable in a page that closes when
you close the tab. We would rather describe it than pretend the code is not there.
If you ring the phone number instead, that call is an ordinary telephone call handled by the phone network, exactly like any other. This website is not involved in it.
What this page is not
The limits of this statement
This page describes the behaviour of this website as it is built. It is deliberately not a compliance document. Granite Ridge Roofing is a fictional business invented for a design demonstration, so there is no company here to make a legal undertaking, no data protection officer to name, no retention schedule to publish and no regulator to answer to. We are not claiming compliance with GDPR, CCPA or any other regime, because a demonstration site is not a party that can be compliant with anything.
What this page does claim is narrower and checkable: that the cookie count is zero, that the storage inventory above is complete, and that no data typed into this site reaches any server in this build. All three of those can be verified in about a minute with your browser's developer tools — application panel for storage, network panel for requests. We would encourage it. A privacy page you can check is worth more than one you have to believe.
One deliberate exception is worth spelling out. The contact page draws its map as a static panel in this site's own colours, with a button underneath it. Nothing is requested from Google until you press that button. If you do press it, an embedded Google map is inserted into the page and everything after that point is Google's, including whatever it chooses to store. That is your decision to make, which is exactly why it is a button rather than an iframe that loads itself.
The site also links outward — to a phone number, to an email address, and from the footer to social profiles. Anything you do after following a link off this site is governed by wherever you have arrived, not by this page.
Straight answers
Questions about storage
Does this site use cookies?
No. Not first-party, not third-party, not analytics, not advertising, not session cookies. No document.cookie write exists anywhere in this build, so there is no cookie banner to negotiate with and no vendor list to read.
What about analytics — Google Analytics, Meta Pixel, anything?
None are loaded. There is no tag manager, no pixel, no heatmap tool, no session recorder and no A/B testing script. The only JavaScript on the page is this site's own, served from this domain.
So what is stored on my device?
Three localStorage keys — dryside.prefs, dryside.brand and dryside.consent — which hold your own display choices and nothing else. They stay in your browser, on that device. They are never read by a server, because nothing on this site sends them anywhere.
What happens if I fill in one of the forms?
In this demonstration build, nothing. The forms post to a webhook address that is configured as an empty string, so the request is not made and the data does not leave the page. On a live deployment that address would point at the business's own lead system, and this page would have to be rewritten to say so.
Are the fonts or images loaded from somewhere else?
No. Both typefaces are self-hosted in /fonts on this domain and every image is served from this domain. There is no Google Fonts request, no CDN and no embedded map iframe loading until you ask for one.
How do I delete everything?
Press "Don't save anything" in the storage notice, or clear site data for this domain in your browser settings. Both remove all three keys immediately. Nothing survives elsewhere, because nothing was sent elsewhere.