Privacy & Compliance: Zero PII, Cookieless, GDPR

At ScaleDynamics, we believe that optimizing web performance and maximizing ad yield should never come at the expense of user privacy. The Impulse Engine was built from the ground up to be Privacy-First by Design.

Our engine profiles the physical capabilities of the machine, not the identity or behavior of the human.

Because it operates entirely on raw hardware heuristics, ScaleDynamics natively complies with the strictest global privacy frameworks, including GDPR, CCPA, and Apple’s ITP.

The 3 Pillars of ScaleDynamics Privacy

1. Zero PII (No Personal Data)

The Impulse Engine does not collect, process, transmit, or store any Personally Identifiable Information (PII).

• No IP addresses are logged.
• No email addresses, names, or user IDs are accessed.
• No geolocation data (GPS) is requested.

2. 100% Cookieless & Stateless

We do not rely on legacy web storage mechanisms. The evaluation happens in real-time, in a vacuum, for each specific page load.

• No Cookies: We do not drop or read first-party or third-party cookies.
• No Local Storage: We do not write to localStorage, sessionStorage, or IndexedDB.
• No Cache Tracking: We do not use cache headers to re-identify returning users.

3. Anti-Fingerprinting Guarantee

Device fingerprinting is a malicious practice used to track users across the web by combining hardware signals into a unique identifier. ScaleDynamics strictly prohibits and prevents fingerprinting.

• We evaluate hardware to group devices into broad, generalized categories (e.g., sd_inventory_tier=1 or Tier 3).
• Hundreds of thousands of users share the exact same hardware profile (e.g., an iPhone 15 running Safari).
• The data cannot be used to isolate, uniquely identify, or track an individual user across different websites or sessions.

Global Regulatory Compliance

Because the Impulse Engine strictly analyzes anonymous, localized device capabilities (such as logical processor cores or WebGL rendering context), it aligns seamlessly with major privacy legislation.

European Union: GDPR & ePrivacy Directive

Under the General Data Protection Regulation (GDPR), personal data requires explicit consent for processing. Because ScaleDynamics processes zero personal data and does not use tracking cookies, it operates outside the scope of GDPR consent requirements for tracking.

• Note: While our script is inherently compliant, you should always list ScaleDynamics as a technical vendor in your Privacy Policy for full transparency.

California: CCPA & CPRA

The California Consumer Privacy Act regulates the sale and sharing of personal information. ScaleDynamics does not collect or share consumer information, meaning our engine does not trigger "Do Not Sell or Share My Personal Information" opt-out requirements.

Apple ITP, Firefox ETP, & Brave

Modern browsers heavily restrict cross-site tracking and third-party cookies (Intelligent Tracking Prevention / Enhanced Tracking Prevention). Because the Impulse Engine executes locally and statelessly (sd-metrics.js), it is completely immune to browser-level tracking preventions and will never trigger privacy warnings or ad-blocker penalties based on tracking heuristics.

Consent Management Platforms (CMP) Integration

Because the Impulse Engine is strictly functional and anonymous, it does not legally require integration with the IAB TCF (Transparency and Consent Framework) v2.2 strings or a user "Opt-in" to function.

Best Practice for Deployment: To accurately capture your hardware metrics and prevent UI lag as early as possible, we recommend executing sd-metrics.js before the CMP loads. This ensures your Ad Server or React app has the hardware scores ready the moment the user grants ad consent, without adding unnecessary latency to the auction or rendering path.

Data Security Architecture

• Phase 1 (sd-agent.js): Sends strictly aggregated, anonymized telemetry (e.g., "15% of traffic is Tier 1") via secure HTTPS to ScaleDynamics servers solely for generating your 24-Hour Audit.
• Phase 2 (sd-metrics.js): Operates 100% client-side. The hardware evaluation occurs locally in the user's browser, and the resulting scores (like sd_inventory_tier or bdp) never leave the device via our systems. They are simply exposed to your local environment for your Ad Server or frontend code to consume.