Cookies and tracking

Strictly necessary

These make the site work and cannot be switched off from here. Blocking them breaks sign-in or checkout.

• Session and authentication: keeps you signed in between pages.
• Security: protects form submissions against cross-site request forgery.
• Stripe: set during checkout to process payment and detect fraud.

Our own identifier

We generate a random client identifier and store it in your browser's local storage under the key pc_cid. It is not a cookie, it does not expire on its own, and it exists so that a visit and a later purchase can be recognised as the same person for attribution. Clearing this site's browser storage removes it.

Where you came from

When you arrive from a search result, a link or an advertisement, the address you arrive on often carries parameters that say which one it was. We copy them into a cookie named pc_attr, set on protocol-club.com and its subdomains, and it lasts ninety days. That is the window Google uses to credit an advertising click, and the cookie exists for the same reason: the training product is on app.protocol-club.com, a different address from this one, so without something that both can read we would not know that a person who signed up there had arrived here first.

It holds the campaign parameters, the advertising click identifiers, the first page of ours you landed on, and the site that sent you. It holds no name, no email address and nothing you type. Deleting this site's cookies removes it, and refusing cookies entirely stops it from being written at all.

Analytics

Google Analytics 4 measures which pages are read and how people arrive. It sets its own cookies in your browser, and we also send the same events server to server through the Measurement Protocol, which means blocking the browser tag alone does not stop all of it.

Microsoft Clarity records how a visit unfolds on the page: clicks, scrolling, mouse movement and the pages viewed, which we replay as session recordings and heatmaps to find where the site is confusing. It sets its own cookies, the data goes to Microsoft, and it runs in your browser only, so a content blocker stops all of it.

Advertising

The Meta Pixel measures and targets advertising. It sets its own cookies, and it is doubled by a server-side interface, Meta's Conversions API, which sends the same events directly from our servers. A TikTok pixel ran here until 1 October 2026 and has been removed.

This is the part that counts as sharing your personal information for advertising under California law. Our do not sell or share page explains how to opt out.

We do not ask for consent before loading these

We state this plainly rather than let you assume otherwise. The advertising and analytics tags load when you arrive, and this site does not show a consent banner. That follows the opt-out model that United States privacy laws use, where you have the right to refuse rather than the obligation to agree first. It would not be sufficient under European or United Kingdom rules, which require consent before non-essential storage, and if you are reading from there you should assume this site is not set up for you.

How to refuse

These take effect immediately and do not depend on us:

• Use a content blocker or your browser's tracking protection. The analytics and advertising tags will not load.
• Turn on Global Privacy Control, the standard browser opt-out signal.
• Clear this site's browser storage to remove pc_cid and the tag cookies.
• Ask us directly through the contact form, which also stops the server-side sharing that a browser blocker cannot reach.

Why a browser blocker is not enough on its own

The Google Analytics and Meta tags each have a server-side counterpart. Blocking the browser script stops what your browser sends, and does not stop what our server sends. Only the request through our contact form stops both. We would rather say this than let a blocker give you a false sense of completeness.