This Privacy Policy explains what data GTM Onion collects when you use gtmonion.io, why we collect it, and the choices you have. GTM Onion is operated by Artūrs Vīgants, Latvia. It is the “data controller” for the purposes of the EU General Data Protection Regulation (GDPR).
1. The short version
- You don’t need an account, and we don’t ask for your name, email or payment details to use the tool.
- We use Google Analytics to understand how the site is used — but only if you agree via the cookie banner.
- The containers you analyze are processed to generate your breakdown, and your results are stored locally in your own browser, not in an account on our servers.
- You can change or withdraw your cookie consent at any time via the “Cookie settings” link in the footer.
2. What we process and why
Containers you submit for analysis
When you analyze a container, the input you provide is sent to our server to produce the analysis:
- A page URL — our service visits the page to detect its Google Tag Manager ID, then downloads the publicly served container.
- A GTM container ID — we download the publicly served container for that ID.
- A JSON export you upload — the file is read in your browser and its contents are sent to our server to be analyzed. Container data may be processed by an automated/AI naming step to turn cryptic identifiers into human-readable names.
This data is processed only to provide the analysis you requested. Please do not upload exports that contain personal data or secrets you are not authorized to share — a GTM container export can include configuration values such as IDs and keys.
Results stored in your browser
The analyzed result is stored in your browser’s localStorage so it can be displayed in the
workspace. It stays on your device until you clear it or clear your browser storage. We do not use it to
build a profile of you.
Usage analytics
If you consent, we use Google Analytics 4 to measure aggregate, anonymous-by-default usage (pages viewed, broad device/browser info, and events such as which input method you used). This helps us improve the tool. Analytics cookies are not set until you accept them.
Server logs & security
Our hosting and security provider, Cloudflare, processes technical data (such as IP address and request metadata) to deliver the site securely and protect it from abuse. This is necessary to run the service.
3. Cookies & similar technologies
A cookie is a small file stored by your browser. We group cookies into Necessary (required
for the site to work and to remember your consent choice) and Analytics (optional, set only
with your consent). The table below lists the cookies set on gtmonion.io:
| Cookie | Set by | Category | Purpose | Retention |
|---|---|---|---|---|
consent |
GTM Onion (first-party) | Necessary | Remembers your cookie consent choice so the banner isn’t shown again. | ~6 months |
CF_Authorization |
Cloudflare | Necessary | Access control / authentication for protected areas of the application. | ~24 hours |
CF_AppSession |
Cloudflare | Necessary | Maintains a secure application session. | Session |
_ga |
Google Analytics | Analytics | Distinguishes individual visitors to compile aggregate usage statistics. | ~13 months |
_ga_* |
Google Analytics | Analytics | Persists the analytics session state for the GA4 property. | ~13 months |
Third-party content (YouTube)
Our homepage embeds a demonstration video hosted on YouTube. When the player loads, Google/YouTube may set
its own third-party cookies (for example VISITOR_INFO1_LIVE, YSC and
VISITOR_PRIVACY_METADATA) to remember playback preferences and measure views. These cookies are
set and controlled by Google, not by us, and may change over time. For details see the
Google Privacy Policy and
how Google uses cookies.
4. Legal bases (GDPR)
- Consent — for analytics cookies and any non-essential tracking. You can withdraw it at any time.
- Performance of a service / legitimate interests — for processing the container you submit in order to return your analysis, and for necessary security and anti-abuse measures.
5. Sharing & international transfers
We use a small number of processors to run the service: Google (Analytics and the embedded video), Cloudflare (hosting & security), and a third-party AI provider used for the naming step. These providers may process data outside your country, including in the United States, under appropriate safeguards. We do not sell your personal data.
6. Retention
Container inputs are processed to generate your analysis and are not used for any other purpose. Analytics data is retained according to our Google Analytics configuration. Results you see in the workspace live only in your browser’s local storage until you clear them.
7. Your rights
Under the GDPR you may request access to, correction of, or deletion of your personal data, object to or restrict processing, and request portability. You can also withdraw cookie consent at any time and lodge a complaint with your local data protection authority (in Latvia, the Data State Inspectorate).
8. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be reflected by updating the “Last updated” date at the top of this page.
9. Contact
Questions about this policy or your data? Email artuursviigants@gmail.com.