Adding cookie consent

When I added user accounts, Now I Get It! started using cookies for the first time -- a refresh token for auth and signed cookies for private page access. Google Analytics was already setting its own cookies. But the privacy policy still said "we do not use persistent first-party cookies." That needed fixing.

The banner

I built a consent banner as a self-contained JavaScript file following the same pattern as the existing footer and feedback widget -- an IIFE that injects its own styles and DOM elements, no build step required. On a fresh visit, a fixed bottom banner offers two choices: "Accept All" or "Essential Only." The choice is stored in localStorage.

The key change is that Google Analytics no longer loads unconditionally. I removed the inline GA script tags from all 14 HTML pages and replaced them with a single reference to the consent script. GA now loads dynamically only when the user has opted in. If they choose essential-only, no analytics code runs and no tracking cookies get set.

A "Cookie Settings" link in the footer lets users change their mind later, re-showing the banner and clearing any existing analytics cookies.

Clearing cookies across domains

One thing that tripped me up during testing: choosing "Essential Only" wasn't actually removing the GA cookies. The _ga cookies were set on .nowigetit.us (the parent domain), but my cleanup code was only trying to clear them on test.nowigetit.us (the hostname). Browsers require the domain to match exactly when deleting cookies. The fix was straightforward -- try clearing on the hostname, the dotted hostname, and the parent domain.

A deploy that broke auth

Deploying to the test environment caused a regression I didn't expect. After the deploy, logging in on Safari and navigating to My Gallery redirected back to the home page -- as if the user had been silently logged out.

The cause wasn't my code. The feature branch had been created before a recent fix that routes API calls through CloudFront for same-origin cookies. Deploying the CloudFormation stack from the older branch reverted that change, making the auth cookie cross-origin again -- which Safari blocks. A rebase onto the latest release branch picked up the fix and restored auth.

It's a good reminder that CloudFormation deploys are declarative. If your branch is missing a resource that exists in the live stack, deploying will remove it.

Privacy policy

I updated the Cookies and Tracking section of the privacy policy to reflect reality. It now describes three categories -- strictly necessary cookies set on login, optional analytics cookies gated by the consent banner, and browser local storage -- without naming specific cookies. The old claim about not using persistent cookies is gone.