Privacy policy
How the Cormorant advertising service, operated by Yagni, handles data. Last updated 5 November 2026.
Cormorant is a bidder: when a website or app shows an ad slot, an ad exchange or the publisher sends us a bid request, and we decide whether to bid. This policy covers that service, the ads it serves, and the measurement pages advertisers place on their own sites. It does not cover the websites or apps where ads appear; they have their own policies.
Data we receive in bid requests
A bid request can contain: your IP address, your browser or app user agent, device type and operating system, approximate location derived from the IP address or supplied by the sender, the page or app where the slot is, the publisher's identifiers, and, where a cookie sync has happened, the Cormorant user id described below. We also receive the privacy signals the sender attaches: COPPA flags, GDPR applicability and an IAB TCF consent string, the US Privacy (CCPA) string, and GPP strings.
What we do with it
- Deciding whether to bid: matching the request against a campaign's targeting (country, device, time of day, content category), filtering invalid traffic (data-centre IP ranges and known bot user agents), and checking supply-chain data (ads.txt, sellers.json, schain).
- Frequency capping: limiting how often one device sees the same campaign, using the Cormorant user id when present.
- Measurement: counting impressions, clicks and conversions per campaign, and learning aggregate click-through and price statistics per device type, operating system and exchange.
- Billing and audit: keeping a journal of money movements, and a bounded log of recent decisions and a rolling capture of recent requests for debugging and dispute resolution.
We do not build interest profiles, we do not sell personal data, and we do not use the data for anything other than running, measuring and auditing the advertising described here.
How we honour privacy signals
- Children: a request flagged under COPPA never gets a bid.
- GDPR and UK GDPR: when the request says GDPR applies, or when it is silent and the device is in the EEA or UK, we bid only with a TCF v2 consent string that grants the required purposes. Without it, the request is treated as consent-less: no frequency capping by user id and no personalised decision.
- CCPA: a US Privacy string with opt-out-of-sale set is honoured; no user id is used.
- GPP: we do not decode GPP strings yet. When one is present, we treat the request as opted out and disable use of personal data.
Cookies
When an exchange performs a cookie sync, we set one first-party cookie, cmuid, on our own domain. It holds a random identifier with no personal information in it, is marked secure, and expires after 90 days. It is used for frequency capping and to match our id to the exchange's. Clearing cookies in your browser removes it.
On an advertiser's landing page, the advertiser may include our measurement script. Arriving from one of our ads with a click id in the address, the script stores that click id in a first-party cookie on the advertiser's site for 30 days so a later purchase can be attributed to the click. That cookie belongs to the advertiser's site, not ours.
Retention
- Request capture used for debugging is a rolling file of bounded size; old entries are overwritten by new ones.
- The decision log holds only the most recent decisions in memory.
- Aggregate statistics (click-through and price estimates) contain no identifiers.
- Billing records for impressions, clicks and conversions are kept as long as required for accounting and disputes.
Sharing
Our bid responses go back to the exchange or publisher that sent the request. Advertisers see aggregate reports for their own campaigns and the click ids of their own conversions. We use hosting providers to run the service. We do not share data with anyone else except where the law requires it.
Your rights
Depending on where you live you may have the right to access, correct or delete personal data, or to object to its processing. Because the only identifier we hold is the random cmuid cookie value, we need that value to find anything about you; it is visible in your browser's cookie settings for this domain. Write to andrew@yagni.co and we will respond within 30 days.
Changes
We will update this page when the service changes. The date at the top says when.
Contact
Yagni, operator of Cormorant. andrew@yagni.co