AirDust Cookies and Trackers Notice

Last updated: 2026-06-03

AirDust does not use cookies, web beacons, pixel tags, advertising identifiers, browser fingerprinting, or any third-party analytics or tracking technology in either the Connect IQ widget or the public end-user surfaces of the Backend service. The one exception is paying for Pro: the Unlock Pro button on the homepage (/) and the optional checkout page (/buy) load PayPal's checkout — but only if and when you tap to pay — and PayPal then sets its own strictly-necessary cookies to process the payment you have requested (see "Payment checkout" below). Until you tap to pay, no PayPal cookie, script, or similar technology is set on either page.

End-user widget and public Backend endpoints

The Connect IQ widget runs on your Garmin device. Garmin Connect IQ does not expose a browser cookie store to widgets, and AirDust does not request, set, or read any storage that would qualify as a cookie under Article 5(3) of Directive 2002/58/EC ("ePrivacy Directive").

The Backend's public end-user endpoints authenticate the Pro tier with a token sent in the HTTP Authorization header. A header token is not a cookie — it is a different transport mechanism, intentionally chosen so that no information is stored in your phone's or watch's browser cookie jar by AirDust.

Other than the optional payment-checkout page described below, the Backend does not include any third-party scripts, advertising network, retargeting pixel, social-media share widget, or analytics SDK on any public response. The privacy policy in privacy-policy.md lists every sub-processor; none of them deploy a tracking technology on the end-user surface.

Payment checkout (homepage and /buy)

Paying for the Pro upgrade uses PayPal's official JavaScript SDK (https://www.paypal.com/sdk/js) to render the PayPal payment buttons and process your payment securely. This applies in two places: the Unlock Pro button on the homepage (/) and the dedicated checkout page (/buy). In both places, to avoid setting any third-party technology before you act, the PayPal SDK loads only when you tap to pay — not on page load. Until you take that action, no PayPal cookie, script, or similar technology is set, and simply viewing the homepage or /buy sets no non-essential third-party cookie.

When you do initiate payment, PayPal may set its own cookies and similar technologies for payment processing, fraud prevention, and security. PayPal acts in two capacities here, consistently with the privacy policy: it is a processor when it handles the specific payment you instruct on the operator's behalf, and a separate, independent controller for its own payment-network and fraud-prevention purposes — including the cookies it sets for those purposes, which it governs under PayPal's own cookie and privacy policies (https://www.paypal.com/legalhub). All of these cookies are strictly necessary to provide the payment service you have explicitly requested.

The PayPal SDK and PayPal's payment APIs are operated globally, so this involves a transfer of your data to PayPal entities outside the EEA (including the United States). That transfer is safeguarded by the EU-US Data Privacy Framework (PayPal's relevant US entity is self-certified under the DPF, whose adequacy decision was upheld by the General Court in September 2025, *Latombe v Commission*, T-553/23); where the DPF does not cover a particular PayPal entity or recipient, the transfer relies on the 2021 EU Standard Contractual Clauses.

AirDust itself sets no analytics or advertising cookies on these pages, and no AirDust cookie is required to view them. If you never start a payment — on the homepage or /buy — none of these technologies are loaded.

Operator-only admin interface

The Operator uses a private administrative interface to run the service. End users never visit it, and it is restricted to the Operator and protected by strong authentication.

When the Operator signs in, the Backend issues a single first-party session cookie. This cookie:

• Is HttpOnly, Secure, and SameSite=Strict.
• Contains an opaque session identifier (no personal data).
• Is scoped to the admin interface only; it is never sent to the public app or any end-user endpoint.
• Is strictly necessary for the operation of the admin interface and therefore exempt from prior-consent requirements under Article 5(3) of the ePrivacy Directive (Recital 25 and the EDPB 2/2023 Guidelines on the technical scope of "strictly necessary" cookies).

No analytics, profiling, or third-party cookies are set on the admin interface either.

Do Not Track

AirDust honours the absence of any tracking — there is nothing to opt out of, by design.

Changes

If AirDust ever introduces any cookie or comparable tracking technology on a public end-user surface, this notice will be updated and a banner requesting prior consent will be displayed before the technology is set, in line with the ePrivacy Directive and EDPB guidance.

Contact

Ivaylo Minkov — airdust.app@gmail.com — Sofia, Bulgaria.