Cookie policy
Last updated: May 5, 2026
We use as few cookies as legally and operationally possible. This page lists every cookie we set, why, and how to opt out of the optional ones.
The short version
- Strictly necessary (auth, CSRF, session): always run. Required for the platform to work.
- Analytics (Plausible, no cookies): off by default. Opt in via the cookie banner.
- Third-party tracking: we use none. No Facebook Pixel, no Google Analytics, no LinkedIn Insight, no retargeting.
Strictly necessary cookies
| Name | Purpose | Lifetime |
|---|---|---|
| adp.session | JWT session token (HttpOnly + Secure + SameSite=Lax) | 30 days rolling |
| adp.csrf | CSRF protection for mutating requests | Session |
| next-auth.callback-url | Auth.js post-login redirect | Session |
These cookies are required for sign-in, multi-tenancy, and CSRF protection. They can't be disabled without breaking the application.
Optional cookies
| Name | Purpose | Lifetime |
|---|---|---|
| adp.cookie-pref.v1 | Remembers your cookie consent choice (localStorage, not a cookie technically) | Indefinite (clear localStorage to reset) |
| adp.theme.v2 | Remembers your theme preference (dark / light / stripe) | Indefinite |
| adp.theme.v1 | Legacy theme key (migrated to v2 when present) | Indefinite until cleared |
| adp.whats-new.v0.4.0 | Whether you've seen the latest 'what's new' toast | Until next release |
These are technically localStorage entries, not HTTP cookies. Listed here for completeness. They store user-preference state, not tracking.
Analytics: privacy-respecting Plausible
When you opt in via the cookie banner, we load Plausible Analytics. Plausible is a privacy-first product based in the EU. It does not use cookies. It does not track users across sites. It does not collect personal data.
What it does: counts pageviews per URL + referrer per day. Used to know whether our marketing pages are working.
Their privacy policy: plausible.io/privacy.
Third-party trackers we don't use
- Google Analytics
- Facebook / Meta Pixel
- LinkedIn Insight
- Twitter / X conversion tag
- HotJar / FullStory / session replay tools
- Mixpanel / Amplitude / Heap
- Marketing-automation pixels (HubSpot, Marketo, etc.)
We don't use any of these. Visitor data does not leave our infrastructure.
How to control cookies
- Cookie banner: bottom-right of every page on first visit. Pick "Strictly necessary only" (default) or "Accept all."
- Browser controls: all major browsers let you block or clear cookies per-site.
- Reset preference: clear localStorage for autodealerpro.io and the cookie banner returns.
Questions? privacy@autodealerpro.io