Cookie Policy
What we store on your device, why, for how long – and how to change your choices at any time.
Last Updated: September 29, 2026
Cookies are small text files a website stores on your device. On our public website we group them into three categories. Strictly necessary storage is always on; analytics and marketing are denied by default and load only after you allow them. Until you consent, no Google, Microsoft or Meta script loads at all; after that we pass your choice to Google through Consent Mode v2.
Our legal basis for strictly-necessary storage is our legitimate interest in operating a secure service (and, for the consent record, a legal obligation). For analytics and marketing the basis is your consent, which you can withdraw at any time below. Microsoft Clarity does not record the signed-in dashboard or result pages; the Google and Meta tags load in the dashboard only with your consent, to measure sign-ups and purchases. Nothing loads in the admin area. The wider data-protection detail lives in our Privacy Policy (Section 8).
Separately, we count visits with Umami, which we host ourselves in the EU. It sets no cookie, reads nothing from your device beyond what every page request carries, strips identifiers and click ids from the addresses it records, and shares nothing with third parties. It runs regardless of your cookie choice, because it is how we decide what to build and where to advertise. You can switch it off for this browser under ‘Your choices’ below.
What we use
Cookies by category
Strictly necessary
Always active – required for sign-in, security and to remember your cookie choice. No consent is asked because the site cannot work without them.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| cc_cookie | HTPBE (first-party) | Stores your cookie-consent choice so the banner is not shown again. | 6 months |
| authjs.session-token, authjs.csrf-token | HTPBE (first-party) | Keeps you signed in and protects forms against cross-site request forgery. | Session / short-lived |
| htpbe_anon_uploads | HTPBE (first-party) | Lets you claim the results of files you checked before signing in, once you create an account. | 24 hours |
| htpbe_currency, htpbe_euvat | HTPBE (first-party) | Shows prices in your currency and whether VAT applies, from your country. | 24 hours |
| theme, umami.disabled (local storage); htpbe_signin_email (session storage) | HTPBE (first-party) | Remember your light/dark theme, your opt-out from our cookieless traffic analytics, and the email address you are signing in with. | Until cleared / end of tab session |
| htpbe_dp | HTPBE (first-party) | Set on the sign-in page only. Holds a one-way code derived from coarse device characteristics, used to stop one person opening several accounts to collect the free credits repeatedly. It cannot be read by scripts and is not used for advertising or analytics. | 24 hours |
Analytics
Off until you allow them. Help us see which pages are useful so we can improve them. Our cookieless traffic counter (Umami) runs without consent and sets no cookie – see below.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _ga, _ga_* | Google Analytics 4 | Distinguishes visitors and sessions to produce aggregate usage statistics. | Up to 2 years |
| _clck, _clsk, CLID, MUID | Microsoft Clarity | Session replay and heatmaps on our public pages to find usability problems. CLID and MUID are set on Microsoft domains (clarity.ms, bing.com). | 1 day – 1 year |
Marketing
Off until you allow them. Let us measure and improve our advertising so we do not waste budget on ads that miss the right people.
| Name | Provider | Purpose | Duration |
|---|---|---|---|
| _gcl_au | Google Ads | Conversion linker – measures ad-driven sign-ups and purchases. | 90 days |
| _fbp | Meta (Facebook) Pixel | Measures ad performance and builds advertising audiences. | 90 days |
| htpbe_utm, htpbe_gclid; htpbe_gclid, htpbe_signup_conversion_fired (session storage) | HTPBE (first-party) | First-touch source and ad-click identifier, used to attribute a later sign-up or purchase to the campaign that brought you here, and a flag that stops a sign-up being counted twice. | 90 days / end of tab session |
Your choices
Current consent state
- Always on
Strictly necessary
Sign-in, security and remembering your cookie choice. Always active – the site cannot work without them.
- …
Analytics
Google Analytics and Microsoft Clarity, so we can see which pages help. Our cookieless traffic counter runs without consent and is not part of this category.
- …
Marketing
Google Ads and Meta Pixel, so we can measure and improve our advertising.
Cookieless traffic analytics
Umami, self-hosted in the EU. It sets no cookie and runs without consent; switch it off here for this browser.
Third-party providers
When enabled, these providers receive data directly from your browser and process it under their own privacy policies:
- Google (Analytics & Ads) — policies.google.com/privacy
- Microsoft (Clarity) — privacy.microsoft.com
- Meta (Facebook Pixel) — facebook.com/privacy/policy