Here is the short version. We use a small number of cookies. Some keep you logged in. The rest help us see which pages are actually useful. We do not run third-party advertising cookies, and we do not track you across other websites. That is the whole story, and the sections below spell out the details.
Essential cookies
These keep the product working, and you cannot turn them off without breaking it.
- Authentication and session. Set by Supabase, our auth provider, to keep you signed in and protect your account. Without these you cannot use the dashboard.
- Security. Short-lived tokens that protect forms and prevent abuse.
Analytics
We use Cloudflare Web Analytics, and it sets no cookies whatsoever. It counts page views and nothing else, without advertising cookies, without following you around the web, and without building a profile of you. What we collect is aggregate usage, so we can tell which pages actually help people. There is no personal browsing history for us to hold, which also means there is none for us to lose, sell or be asked to hand over.
What we do not use
No advertising cookies. No data brokers. No selling your activity. No fingerprinting for ads. We do not hand your usage to ad networks, and we never will.
Managing cookies
You can clear or block cookies any time in your browser settings. Block the essential ones and you will not be able to stay logged in. Block analytics and nothing changes on the selling or sharing side, because there is nothing to sell or share. It is aggregate and privacy-friendly either way.
What a cookie actually does here
A cookie is a small piece of text your browser stores for a site and sends back on the next request. That is the whole mechanism. It has no way to read your files, your other tabs or anything outside what this site put there. The reason cookies have a bad reputation is not the mechanism, it is what advertising networks built on top of it, which is a thing we do not do.
In practice we set two kinds and nothing else. One keeps you signed in, so the dashboard knows the request is yours rather than a stranger with your link. The other is a short-lived security token that stops a form being submitted from somewhere it should not be. If you never sign in, you can use the free check, the tools and every page on this site without us storing anything in your browser at all.
Third-party content we deliberately avoid
Plenty of sites leak far more through embeds than through their own cookies. An embedded video player, a chat widget, a social feed, a font served from an ad network: each of those can set its own cookies and see your address the moment the page loads, whether or not you interact with it.
We keep that surface close to zero. There is no advertising network on this site, no session recorder watching your mouse, no social embeds and no third-party chat widget. When we need a font it is served from our own domain rather than a third party. That is a deliberate cost we accept, because a privacy policy that says the right words while the page quietly loads six trackers is not worth reading.
Do Not Track and global privacy signals
Some browsers send a Do Not Track header or a Global Privacy Control signal. Honouring them costs us nothing, because we do not sell or share personal information and we do not run behavioural advertising, so there is no tracking to switch off in the first place. If you send the signal, the outcome is identical to not sending it, and we would rather tell you that plainly than claim credit for respecting a preference that never applied.
Changes to this policy
If we ever add a cookie that is not on this page, we update this page before it ships, not afterwards. The date at the top is the honest last-changed date. If a change is material, meaning it affects what is collected rather than how we describe it, we say so in the product rather than relying on you to re-read a policy page.
Contact
Questions? Email [email protected]. See also our Privacy Policy.