Cookie & Storage Policy

Version 1.1 · updated October 14, 2026

1. What this policy covers

How Oakline Heating & Air uses browser storage — cookies and localStorage — when you browse this site and schedule service. The short version: we store your cookie-banner choice, and nothing else. The longer version explains the legal basis and the machinery, because a policy you cannot audit is not a policy.

2. The legal background, in plain English

There is no single U.S. federal cookie statute; the field is a patchwork of state laws. California’s CCPA/CPRA treats certain browser-based identifiers as personal information and requires notice and opt-out mechanisms for their sale or “sharing” (cross-context behavioral advertising); several other states have enacted similar statutes, and the FTC Act’s prohibition on deceptive practices applies to privacy promises everywhere. Our posture is simpler than any of them: we set nothing that those laws would regulate. One local-storage item records your answer to this notice — under any reading of any of these laws, that single functional item is either strictly necessary to the service you requested or not personal information at all, so no consent wall is needed and no content is ever withheld from decliners.

3. What we set

The banner choice is stored under the key bh_ck_v1 in first-party local storage scoped to this domain, for 12 months. Separately, the city name returned by the IP lookup described in section 4 is kept under bh_geo_v1 in session storage — it disappears when the tab closes and is never sent anywhere. Neither key contains an identifier: no pseudonymous ID, no visit timestamp, nothing that can be joined to anything else. Clearing site storage resets both and breaks nothing.

4. Third-party content

Three third parties touch your browser here, all initiated by the page rather than by trackers: Google Fonts serves the typefaces (the font CDN sees a routine file-request log — IP address, user agent, timestamp — which we never receive and never combine with anything); a public “what is my IP” service and an IP-to-city lookup API resolve your city for the local headings (your IP is processed by those services for the lookup only, and the resulting city name stays in your session storage); and, if you tap the phone number, your own phone app handles the call. When you pay by card, the transaction is completed on the processor’s terminal or hosted page under its own terms; our site places nothing at that point and never sees the card.

5. Families we never load by default

• analytics beacons, session replay or heatmapping;
• advertising exchanges, retargeting tags and cross-site identifiers;
• social network widgets, like boxes or comment frames;
• font-loading telemetry beyond the standard CDN request log.

6. If measurement is ever added

Should we ever want aggregate usage statistics, they will arrive only as an explicit banner category with equal-weight accept/decline buttons, disabled until you choose, listed in plain language before activation — and this policy will be re-issued with a new version date first. Decline will remain permanently available, not hidden behind a second screen. Where a state law requires a “Do Not Sell or Share” link or honors a Global Privacy Control signal, we will honor both — trivially, since there is nothing to opt out of.

7. Your controls

You can clear site data any time in your browser settings (Chrome: Settings → Privacy → Site data; Firefox: Settings → Privacy & Security → Cookies; Safari: Preferences → Privacy → Manage Website Data; Edge: Settings → Cookies and site permissions). If you would rather we reset the banner choice manually, email [email protected] with “cookie preference reset” and we will walk you through the two clicks on your own device — we cannot and do not set anything remotely.

8. Questions and complaints

Questions go to [email protected] with “cookie policy” in the subject; we answer within 5 business days. Storage-related complaints can also go to the Ohio Attorney General’s consumer protection division, or to your own state’s attorney general under your state’s privacy statute. This policy is reviewed annually and after any relevant FTC or state guidance change.

9. Category-by-category analysis

For completeness, here is how each common cookie category maps onto this site. Strictly necessary: only the banner-choice record in section 3 — functional storage whose sole job is remembering the answer you already gave. Preferences: none — we hold no theme, language or accessibility settings in storage. Statistics: none — we run no analytics of any kind on this site; our measure of whether the site works is whether the phone rings. Marketing: none — no remarketing audiences, no lookalike seeds, no social pixels, no email-capture popovers. If any of these categories is ever introduced, section 6 describes the consent-first procedure that would precede it, and this analysis will be rewritten to describe reality rather than intent.

10. The banner, technically

The banner is a plain element in the page markup, shown and hidden by one inline script; it is not injected by a consent-management platform, does not call home, and its buttons write only the choice key described above. “Accept” and “Decline” have identical visual weight and, today, identical consequences — the site stores nothing else either way. There is no pre-ticked state, no scrolling-as-consent, no re-prompt after decline, and nothing withheld from decliners. Users of script-blocking extensions will simply never see it, and lose nothing by the absence.

11. Relationship with the Privacy Policy

This document governs storage on your device; the Privacy Policy governs personal information once it reaches us. The two meet at exactly one point: the banner choice contains no personal information of any kind, and scheduling-form data exists in the browser only until you submit it, at which moment the Privacy Policy takes over. Neither document asks you to waive any right, and nothing here overrides state privacy statutes where they apply.

12. Practical answers to practical questions

“Will declining cookies break the scheduling form?” No. The form works identically either way; it submits when you press the button and stores nothing in between. “Do you fingerprint my browser?” No — no scripts run for that purpose and none of the served assets attempt it. “Does the phone number in the header track me?” It is a plain link your phone app handles; we see only what your carrier sees. “What if my browser blocks everything?” The site is fully usable: typefaces fall back to system fonts, pages render identically, and the only visible difference is that the banner never appears. “How do I know this policy is true?” Open your browser’s developer tools, the Storage or Application tab, and look — you will find the single key named in section 3 and nothing else from this domain. That is the test we invite you to run.

13. One-paragraph summary

If you read nothing else: this website sets one item of browser storage — the record of your answer to this notice — and nothing more. No analytics, no advertising, no social pixels, no fingerprinting, no session replay. The fonts arrive from a public CDN that sees a standard file request. The scheduling form transmits your details only when you press submit, at which point our privacy policy takes over and this one ends. Anyone who tells you a small local heating company needs tracking cookies to service furnaces is selling something; we are not.

14. Version history

1.1 (14 Oct 2026) — initial issue for the heating-service site, no storage behavior to change. Prior versions are available on request — a cookie policy you cannot compare against its predecessor is a policy you cannot audit, so we keep them all.