Last updated: October 23, 2026. This version takes effect on that date.
This policy explains the cookies and similar technologies (pixels, scripts, local storage and embedded content) used on arctostactical.com. The site is operated by Arctos Industries USA LLC (Arctos Tactical), 1575 South River Road, St. George, UT 84790. See also our Privacy Policy at https://arctostactical.com/privacy-policy/.
Your choices
When you first visit, our banner lets you choose Accept All, Reject, or Preferences.
- Accept All turns on session recording (Microsoft Clarity) and advertising and marketing cookies.
- Reject turns off session recording (Microsoft Clarity) and advertising and marketing cookies. It does not turn off strictly necessary cookies, functional items such as your wishlist and our sign-up offer reminder, or basic site statistics and analytics (Jetpack Stats and Google Analytics). It also doesn’t stop the Meta (Facebook) code that loads with our GoHighLevel newsletter signup form, described in the table below.
- Preferences lets you choose by category.
Until you choose, session recording and advertising and marketing cookies don’t run. You can change your choice any time with “Cookie Preferences” in the footer or the floating cookie button. If your browser sends a Global Privacy Control (GPC) signal, we treat it as a rejection of session recording, advertising and marketing cookies and as an opt-out of any “sale” or “sharing” of your personal information. GPC also switches off Google Analytics for that browser, but it doesn’t turn off Jetpack Stats. You can also delete or block cookies in your browser settings.
Categories
Strictly necessary items always run, because the site can’t work safely without them: the cart, checkout, sign-in, remembering your cookie choice, payment security, and protection against bots and fraud.
Functional items remember features you use, such as your wishlist and whether you’ve closed or completed our email sign-up offer. They always run.
Basic statistics help us count visits and understand how the site and store are used. We use Jetpack Stats, provided by Automattic Inc. (the company behind WordPress.com, which hosts our site). It runs for all visitors and isn’t switched off by Reject or GPC. We use it only to understand and improve our site. It isn’t used for advertising, and we don’t sell this data. Jetpack Stats records page views, referring sites and search terms, outbound link clicks and country, using your IP address, browser type, browser language and the pages you visit. It also sets a random, pseudonymous visitor ID in cookies (tk_ai and tk_ai_explat) on Automattic’s own wordpress.com domain. Automattic keeps the logs that contain IP addresses for 28 days, and we see only aggregated reports that don’t identify individual visitors.
Basic analytics: Google Analytics. Alongside Jetpack Stats, we use Google Analytics (Google LLC, property G-00GZTJH03F), loaded through Google Site Kit, for basic site analytics. It also runs for all visitors and isn’t switched off by Reject. It records the pages you view, the site that referred you, your device, browser and approximate location (estimated from your IP address), and events such as scrolling, form submissions, add to cart and purchases. It sets the cookies _ga and _ga_* on arctostactical.com, which last up to 400 days. We don’t use Google Analytics for advertising. Unless you choose Accept All or turn on Marketing, our site tells Google Analytics that advertising storage, ad user data and ad personalization are denied. To opt out, turn on Global Privacy Control (we then switch Google Analytics off for that browser), install Google’s opt-out browser add-on (https://tools.google.com/dlpage/gaoptout), or block or delete cookies in your browser.
Statistics: session recording, only with your consent. The “Statistics” switch in Preferences controls Microsoft Clarity (Microsoft Corporation), loaded through Google Tag Manager. Clarity is a session-recording tool: it records the pages you visit and how you interact with them, such as clicks, taps, scrolling and mouse movement, so we can replay visits and build heatmaps. It masks text you type into form fields. Clarity runs only if you turn on Statistics or choose Accept All, and Reject or a GPC signal keeps it off. We use Clarity only to understand and improve our site, but Microsoft may also use the data it collects for its own purposes, including advertising (see the Microsoft Privacy Statement below). The Statistics switch also controls WooCommerce Order Attribution (the sbjs_* cookies in the table below), which records which ad, site or campaign brought you to us and also runs only with your consent. The Statistics switch doesn’t turn off Jetpack Stats or Google Analytics.
Marketing and advertising items record which campaign or affiliate brought you to us, and let Google (through embedded YouTube video) recognize your browser for measurement and advertising. They run only if you choose Accept All or turn them on in Preferences.
Cookies and similar technologies we use
| Cookie / technology | Provider | Category | Purpose | Duration |
|---|---|---|---|---|
wp_woocommerce_session_*, woocommerce_cart_hash, woocommerce_items_in_cart |
Arctos (WooCommerce) | Strictly necessary | Keeps your cart and checkout working | Session to 2 days |
wordpress_logged_in_*, wordpress_sec_* |
Arctos (WordPress) | Strictly necessary | Signs you in to your account | Session or 14 days |
wpconsent_preferences |
Arctos (WPConsent) | Strictly necessary | Remembers your cookie choice | 30 days |
Google reCAPTCHA (“I’m not a robot” box on account login and checkout): scripts from www.google.com/recaptcha and www.gstatic.com/recaptcha; Google stores rc::a (local storage) and rc::c (session storage) in its reCAPTCHA frame, and may set the _GRECAPTCHA cookie when the check runs |
Google LLC | Strictly necessary (security) | Protects login and checkout against fraud, bots and automated abuse. Google analyses device and interaction information (for example IP address, browser data and mouse or touch activity) to tell people from bots | rc::a: until cleared; rc::c: end of session; _GRECAPTCHA: up to 6 months |
_hcp, _hcc, _hcr |
WordPress.com (Automattic Inc.), our hosting provider | Strictly necessary (security) | “Confirm you are human” check shown to suspected bots | Session or a few minutes |
Meta (Facebook) tracking script connect.facebook.net/.../fbevents.js, loaded by the GoHighLevel newsletter signup form |
Meta Platforms, Inc. (code supplied by GoHighLevel) | Runs with the form, for all visitors | Part of GoHighLevel’s form code. We haven’t set up a Meta pixel or Meta advertising. Meta may receive IP address, browser and device information and the page URL, and may set its own cookies such as _fbp |
Set by Meta; _fbp typically up to 90 days |
WordPress.com Fraud Protection on checkout: requests to blackbox-api.wp.com; cookies __Host-_bb_c_uid and a first-party session tk_ai on checkout |
Automattic Inc. (WordPress.com, our host) | Strictly necessary (fraud prevention) | Helps detect fraudulent orders and card testing, using device and browser information | __Host-_bb_c_uid: 1 year; tk_ai (checkout): end of session |
Apple Pay script from applepay.cdn-apple.com, loaded by our card payment plugin |
Apple Inc. | Strictly necessary (payments) | Part of our card payment plugin’s code. Your browser contacts Apple to load it, which shares your IP address and browser information with Apple | No cookies observed |
GoHighLevel form tracking inside the newsletter signup form: requests to backend.leadconnectorhq.com and a pixel.js script from storage.googleapis.com |
HighLevel Inc. (GoHighLevel / LeadConnector) | Runs with the form, for all visitors | Records form visits and which page or campaign led to a signup, so signups are attributed correctly in our CRM | Set by GoHighLevel inside its form frame |
WordPress.com fonts and page-speed scripts (fonts.wp.com, fonts-api.wp.com, s0.wp.com) |
Automattic Inc. (WordPress.com, our host) | Strictly necessary | Displays the site’s fonts and loads site code quickly. Your browser contacts WordPress.com servers, which receive your IP address and browser information | No cookies observed |
Google Fonts inside the GoHighLevel form and reCAPTCHA frames (fonts.googleapis.com, fonts.gstatic.com) |
Google LLC | Functional | Displays text fonts. Your browser contacts Google to load them, which shares your IP address and browser information with Google | No cookies observed |
__cf_bm |
Cloudflare (on GoHighLevel / LeadConnector form domains) | Strictly necessary (security) | Bot and abuse protection for our forms | 30 minutes |
Card payment fields (secure.nmi.com, Collect.js) |
Our card payment processor (Merchamax / PayBright, via the NMI gateway) | Strictly necessary | Lets you enter card details securely in the processor’s own fields | No cookies observed |
woosw_key |
Arctos (WPC Smart Wishlist) | Functional | Saves your wishlist | 7 days |
arctos_offer (browser local storage on arctostactical.com) |
Arctos | Functional | Remembers whether you closed or completed our email sign-up offer, so we don’t show it again | 14 days after you close it; 1 year after you sign up |
Jetpack Stats (scripts from stats.wp.com and wordpress.com, counting requests to pixel.wp.com); cookies tk_ai, tk_ai_explat on .wordpress.com |
Automattic Inc. | Basic statistics (runs for all visitors) | Counts visits and page views and measures page-loading performance, using a random pseudonymous visitor ID | tk_ai, tk_ai_explat: about 13 months; Automattic keeps logs with IP addresses for 28 days |
_ga, _ga_* (for example _ga_00GZTJH03F) on arctostactical.com; scripts from www.googletagmanager.com (Google tag GT-P3NSSMPH) and requests to google-analytics.com |
Google LLC (Google Analytics) | Basic analytics (runs for all visitors; not turned off by Reject; switched off by GPC or Google’s opt-out add-on) | Counts visits and measures how the site and store are used, telling visitors and sessions apart. Not used for advertising | Up to 400 days (about 13 months) |
_clck, _clsk on arctostactical.com; CLID on www.clarity.ms; Microsoft and Bing ID cookie MUID on clarity.ms and bing.com; related Microsoft cookies MR, SRM_B, SM and ANONCHK on c.bing.com and c.clarity.ms; scripts and requests to *.clarity.ms and c.bing.com, started by Google Tag Manager GTM-K34KW3RK, which we load only after you consent |
Microsoft Corporation (Microsoft Clarity) | Statistics (session recording), only with your consent | Records the pages you visit and your clicks, taps, scrolling and mouse movement for session replays and heatmaps, and links your pages into one session. Masks text typed into form fields. Microsoft may also use this data for its own purposes, including advertising | _clck, CLID: 1 year; MUID, SRM_B: about 13 months; _clsk: 1 day; MR: 7 days; SM, ANONCHK: session or less |
sbjs_current, sbjs_current_add, sbjs_first, sbjs_first_add, sbjs_session, sbjs_udata, sbjs_migrations |
Arctos (WooCommerce Order Attribution) | Statistics (only with your consent) | Records which ad, site or campaign brought you to us | Session |
affwp_ref, affwp_visit, affwp_campaign |
Arctos (AffiliateWP) | Marketing | Credits the affiliate whose link you used | Only set if you arrive through an affiliate link; lasts for our affiliate referral period |
VISITOR_INFO1_LIVE, VISITOR_PRIVACY_METADATA, YSC, __Secure-YNID, __Secure-ROLLOUT_TOKEN, and requests to googleads.g.doubleclick.net and static.doubleclick.net |
Google (YouTube video) | Marketing | Plays embedded video. Google may use these to measure viewing, recognize your browser and for advertising | YSC: session; others: 180 days |
Google reCAPTCHA. Our login and checkout forms are protected by Google reCAPTCHA. Because it guards your account and payments against fraud and automated attacks, it runs whatever cookie choice you make. Google’s Privacy Policy (https://policies.google.com/privacy) and Terms of Service (https://policies.google.com/terms) apply to it.
Third parties’ own policies
- Automattic (WordPress.com, Jetpack): https://automattic.com/privacy/
- Google (Analytics, Tag Manager, reCAPTCHA, YouTube): https://policies.google.com/privacy
- GoHighLevel / LeadConnector: https://www.gohighlevel.com/privacy-policy
- Meta (Facebook), through the GoHighLevel newsletter form: https://www.facebook.com/privacy/policy/
- Google Analytics opt-out browser add-on: https://tools.google.com/dlpage/gaoptout
- Microsoft (Clarity, Bing): https://privacy.microsoft.com/privacystatement
- Cloudflare: https://www.cloudflare.com/privacypolicy/
Changes
We update this policy when our tools change. Questions: Privacy Team, info@arctostactical.com.
