Legal
Cookie Policy
Shortspan sets a handful of strictly necessary cookies and nothing else. No advertising cookies, no cross-site trackers, and no consent banner to dismiss.
- Effective
- Last updated
- Entity
- Shortspan Technologies
01The short version
We use cookies only where the Service cannot work without them: keeping you signed in, protecting forms against cross-site request forgery, and remembering interface preferences you have set yourself.
There is no cookie banner on this site because there is nothing to consent to. Strictly necessary cookies do not require consent under the ePrivacy Directive or the GDPR, and we do not set any other kind.
02Cookies we set
| Name | Purpose | Lifetime |
|---|---|---|
| shortspan_session | Keeps you signed in to the web console across requests | Session, or up to 2 hours idle |
| XSRF-TOKEN | Cross-site request forgery protection for forms and API calls from the browser | Session |
| appearance | Remembers whether you chose the light, dark, or system theme | 1 year |
| sidebar_state | Remembers whether you collapsed the console sidebar | 1 year |
| remember_web_* | Set only if you tick “remember me” at sign-in | 5 years, or until you sign out |
All cookies are set with the `HttpOnly` flag where the browser does not need to read them, with `Secure` on any HTTPS origin, and with `SameSite=Lax` to limit cross-site sending.
03What we do not set
- No advertising or retargeting cookies.
- No third-party analytics cookies, and no Google Analytics.
- No social media pixels, share widgets, or embedded trackers.
- No persistent fingerprinting, and no cross-site identity graph. Our own cookieless analytics count visits with a one-way hash that changes every day and cannot be reversed - see the Privacy Policy.
- No cookies at all on the marketing pages until you sign in - visit the homepage and check.
04Third-party cookies during checkout
When you open a checkout, our payment processor loads its own script and may set cookies necessary to complete and secure the transaction and to prevent payment fraud. Those cookies are governed by the processor’s own cookie policy, and they are only loaded when you actually start a checkout.
05Local storage
The console keeps a small amount of state in your browser’s local storage - the resolved theme and whether you have dismissed the product tour. It is per-browser, never transmitted to us, and clearing site data removes it.
06Controlling cookies
Every major browser lets you view, block, and delete cookies from its privacy settings. Blocking the session and CSRF cookies will prevent you from signing in, because the Service has no other way to recognise your session.
We honour the Global Privacy Control signal, though in practice it changes nothing about what we set, because we do not sell or share personal information.
07Changes and contact
If we ever add a cookie beyond the strictly necessary ones, we will update this table, add a consent mechanism, and announce the change before it takes effect.
Questions: privacy@shortspan.dev.