What we use cookies for
We use cookies to run the service: to keep you signed in, to protect forms, to show a one-time message after an action, and to recognise an anonymous visitor of the free sample. On public pages we also offer optional analytics from Google Analytics. It sets cookies in your browser only if you press "Accept analytics" in the banner, and you can change your choice at any time under "Cookie settings" below or in the page footer. We do not set cookies for advertising.
Analytics is never offered in the signed-in areas (/admin/, /app/, /account/, /report/, /billing/ and similar address-based pages), never to someone who is signed in, and not when your browser sends Global Privacy Control or Do Not Track: we treat that as "No thanks" and show no banner. Before you choose, a visitor who only reads public pages gets one cookie only if a page contains a form (the form protection cookie). We keep no record of your choice on our servers; it exists only in the cx_consent cookie in your browser.
Cookies we can set
| Name | What it is for | When it is set | How long it lasts | HttpOnly | Secure | SameSite | Path |
|---|---|---|---|---|---|---|---|
sitepulse.admin |
Keeps the administrator signed in at /admin. | When the administrator signs in. | Until the browser is closed, and the sign-in itself ends after 8 hours. | Yes | Yes | Lax | / |
sitepulse.account |
Keeps a customer signed in. It carries an encrypted sign-in ticket; the matching session record on the server can be ended by signing out. | When a customer signs in. | Until the browser is closed, and the sign-in itself ends after 8 hours. | Yes | Yes | Lax | / |
sitepulse.2fa |
Remembers which account has passed the password step and still owes a two-factor code. | After a correct password on an account that uses two-factor. | Until the browser is closed, and valid for 5 minutes. | Yes | Yes | Lax | / |
sitepulse.visitor |
Lets an anonymous visitor of the free sample see only their own sample sites. It holds a random identifier and nothing else. | Only when a visitor adds a website in the free sample. | 30 days. | Yes | Yes | Lax | /sample |
.AspNetCore.Antiforgery.uGamEwObQy8 |
Protects forms against requests sent from other websites. It holds a random token. | When a page that contains a form is shown. | Until the browser is closed. | Yes | Yes | Strict | / |
.AspNetCore.Mvc.CookieTempDataProvider |
Carries a one-time confirmation message (for example "Site added") across a page redirect for a signed-in person. | Only after an action in the signed-in area that leaves a message. | Until the browser is closed, and removed once the message is read. | Yes | Yes | Lax | / |
cx_consent |
Remembers your analytics choice. The value is "accept" or "decline" and nothing else. | When you press "Accept analytics" or "No thanks" in the banner or on this page. Not set if your browser sends Global Privacy Control or Do Not Track. | 180 days. | No (the page script has to read it; it holds no secret) | Yes on https | Lax | / |
HttpOnly means page scripts cannot read the cookie. Secure means the browser sends it only over https. SameSite limits when the browser sends it with requests started from other websites.
Strictly necessary and optional cookies
Strictly necessary. The cookies in the table above, except the analytics choice cookie, are needed to give you the service you ask for: to sign in, to protect forms, to show a one-time message and to recognise a free-sample visitor. We set them without asking, because the service would not work without them.
Based on your consent. Analytics is the only optional use. Google's cookies are set only after you press "Accept analytics". The cx_consent cookie only remembers whether you accepted or declined. To change your choice at any time, use the cookie settings below or "Cookie settings" in the page footer.
Cookie names we never use
Two more cookie names are built into the sign-in software we use. Crawvix never sets them, because it has no "remember this browser" option and no sign-in through other services:
sitepulse.2fa-remembersitepulse.external
Cookies from other companies
If you press "Accept analytics", Google's script is added to the page and sets these cookies on our own domain: _ga _ga_<container id> They identify your browser and the visit so Google Analytics can count visits. We have asked Google to keep them no longer than 180 days and to switch off Google signals and ad personalization; those are settings we send to Google, and Google's own notices say how it handles them. If you later press "No thanks", the script removes them from your browser. Our code never writes these cookies, so they are not in the table above. See Google's own notices.
On the checkout page the payment form and its script come from Stripe. Stripe may use its own cookies or browser storage there. We do not control them and do not list them here. See Stripe's own notices.
When the site operator has turned on the Cloudflare Turnstile check, the sign-up, sign-in, forgot-password, new-confirmation-link and free-sample pages load a script and a small frame from Cloudflare. Cloudflare may use its own cookies or browser storage in that frame. We do not control them and do not list them here. See Cloudflare's own notices. The administrator sign-in page does not load it.
Removing cookies and contact
You can delete cookies in your browser settings. Signing out ends your session on our server as well. If you block the form protection cookie, forms on this site will not work.
We update this page when the cookies change; the date at the top shows the latest version. Questions: info@crawvix.com. See also the Privacy notice and the Terms.